Conclusion on initial step of ClamAV.
Although processes of testing in ClamAV program ( AV stand of Antivirus ) included unit-test packages which are implemented in order to test installing packages of ClamAV. This package complex and not suitable for newbies,therefor reading document of it's help how to understanding of API. But that’s some time we come back to see in code of unit test on those which how to call API( We call package of testing of ClamAV is Check framework ). Why we should see testing step on unit test of ClamAV? Because we debug programs on runtime. It’s very complex when various an integrated function until we lost on debug steps.We show easy examples which we need to understand.
- Using make script on examples that Sconstruct tools builds source codes. Scons command-line for execute Sconstruct files. Sconstruct likely Makefile when you compile source codes by
sudo make && make install
But Sconstruct have command-line for typing on directory contains Sconstruct file.“scons”
- Understanding API of ClamAV with the purpose of call function in C language implemented in core of ClamAV.
- Unit test of C languages write for testing modules of ClamAV( ClamAV using Check Framework). We should to how to implemented test case that simultaneously testing and debugging.
- Strategy debugging with GDB that should to know shortcut keys and verify bit on programs.
- Boost library, I implemented programs for call function in ClamAV by C++ languages. In this steps, I using Boost-logging library for write log on console ( As log4j library when implemented programs on Java). Boost-logging invokes path setting a leveled log in file name “setting.txt” ( Example specifies on path /home/chatsiri/settings.txt )
For steps purpose of calling ClamAV function following on initial engines and scan file contain virus. Initialing engines for scanning virus.
Main class call initial and scaning classes.
#include <stdio.h>
#include <stdlib.h>
#include "clamav_init_engines.hpp"
#include "clamav_scan_engines.hpp"
#include <iostream>
int main(int argc, char **argv) {
const std::string file_path = "/home/chatsiri/settings.txt";
const std::string file_included_virus = "/home/chatsiri/clamav/clamav-devel/test/clam-upack.exe";
if(clamav_logger::logger::instance().initLogger(file_path))
{
<span style="white-space: pre;"> </span>CLLOG_TRACE("### Initialization logger completed...");
}
// init & check database engine
clamav_services::init_engine init_engine_(0);
init_engine_.engine();
init_engine_.database_signature_path();
init_engine_.engine_new();
init_engine_.engine_detected();
init_engine_.eninge_db_check();
// scan engine.
clamav_services::clamav_scan scan(file_included_virus,init_engine_.get_engine());
scan.engine_scan();
return EXIT_SUCCESS; }
First, We start with call engine by member function of engine() so that contain functions “int cl_init(unsigned int options);”. You can read a source code at clamav_init_engines.hpp.
Seconds, New engine can be create by the following statement engine_new(). Engine_new call
int cl_load(const char *path, struct cl_engine *engine, unsigned int *signo, unsigned int dboptions);functions which specify path signature of virus.
Third steps, Programs pass initial and new engine. We can check engine by cl_engine_complite member functions which contain function name
int cl_engine_compile(struct cl_engine *engine);
In additional, we can check signature of databases by call function.
cl_statinidir(dbsign_path_.c_str(), &dbstat_);It’s declare in member function name eninge_db_check().We send engine pointer by get_engine() member functions of initial_engine to engine_scan() member function of clamav_scan classes. At step scaning virus you can read a source code at clamav_scan_engines.hpp
clamav_services::clamav_scan scan(file_included_virus,init_engine_.get_engine());
Calling engine_scan() member function for scan file name 'clam-unpack.exe'.
scan.engine_scan();
Only couple steps for scanning files name /home/chatsiri/clamav/clamav-devel/test/clam-upack.exe. Program shows result as "Found virus name = ClamAV-Test-File, Virus(es) detected" in console.
chatsiri@chatsiri:~/workspace/clamav_cpp$ scons scons: Reading SConscript files ... scons: done reading SConscript files. scons: Building targets ... g++ -o clamav_optm.o -c -g -I/usr/include/c++/4.5.2 -I/home/chatsiri/Download2/boost/boost_1_43_0 -Iclamavservices -Iclamavlogger -I/home/chatsiri/Download2/boost/boost_1_43_0/boost-log-1.0 -I/home/chatsiri/clamav/clamav-devel/libclamav -I/home/chatsiri/clamav/clamav-devel/shared clamav_optm.cpp g++ -o clamav_optm clamav_optm.o -L/home/chatsiri/clamav/clamav-devel/libclamav -L/home/chatsiri/Download2/boost/boost_1_43_0/stage/lib -L/home/chatsiri/Download2/boost/boost_1_43_0/bin.v2/libs/log/build/gcc-4.4.3/debug/link-static/runtime-link-static -lclamav -lboost_thread -lboost_regex -lboost_log -lboost_log_setup -lboost_log -lboost_system -lboost_filesystem scons: done building targets. chatsiri@chatsiri:~/workspace/clamav_cpp$ ./clamav_optm ### init logger status = [0] ### Open log configure file = [/home/chatsiri/settings.txt] CLAMAV_CPP = clamav_optm.cpp:23|140402870151008|-### Initialization logger completed... CLAMAV_CPP = clamavservices/clamav_init_engines.hpp:97|140402870151008|-/home/chatsiri/clamav/clamav-devel/database/main.cvd CLAMAV_CPP = clamavservices/clamav_init_engines.hpp:124|140402870151008|-### cl_load init , No viruses detected CLAMAV_CPP = clamavservices/clamav_init_engines.hpp:111|140402870151008|-### Databases not changing. CLAMAV_CPP = clamavservices/clamav_scan_engines.hpp:57|140402870151008|-### Found virus name = ClamAV-Test-File, Virus(es) detected CLAMAV_CPP = clamavservices/clamav_scan_engines.hpp:62|140402870151008|-### Destory engine scanning... ### ~destory logger ### chatsiri@chatsiri:~/workspace/clamav_cpp$
Next issuses:
- How programs can set flag options of load AC or BM algorithms for scanning?
- How to improved code point of AC algorithms? In my opinions, I try to set flag option a scanning on AC algorithm and debug point of scanning with AC.
ClamAV community for developer : clamav-dev, My communicated with people [1],[2].
