C++ project help

atmablade

United States334 Posts

May 13 2008 19:25 GMT

Ok, here's the dire situation. For my project I have to make a very basic virus scanner that takes in two arguments, the directory to start searching files in (then recursively traverse down) and the signature file (just a normal text file formatted however I want it). We can write it in any code (C,C++,Java,Perl) except shell since that would take like 4 lines of code. So I decided to start it in C++ since I'm more familiar with that.

For each file, the program will test if it contains a binary substring than matches a signature listed in the input file.
Then the output of the program is a report that indicates which files in the directory contain which signatures in the list.

The signature file I have setup right now is very basic and looks like this:

abc
1a2a3a

Now onto my plead. From what I get, I have to compare both files on a byte to byte level, but how does this work? I'm not sure what the code/pseudo-code looks like for this whole compare part.

The next problem is the recursion. I have never messed with directory traversing much so the code for that is also pretty murky.

Can anyone point me in the right direction and help me out?

zdd

1463 Posts

May 13 2008 19:55 GMT

you basically just want a function that you can put a directory into and loop through each file
convert your search pattern to binary and then to a string for easy comparison (or you can just do binary to binary)

bin_file = to_string(convert_to_binary(input_file))
matches = empty string

function loop_directory(dir) {
      for each file in dir {
            if (file = directory) { loop_directory(file) } //recurse through any subdirectories
             else {
                    file_to_search = open(file)
                    for each character in file_to_search {
                    loop_this_many_times = length(bin_file)-1 //loop through character spot + length of bin_file - 1
                    while loop_this_many_times>0 {
                    active_bin_string[loop_this_many_times] = file_to_search[character+loop_this_many_times]
                    loop_this_many_times--
                    }
                     active_bin_string = reverse(active_bin_string) //reverse it because you searched backwards
                    if bin_file = to_string(active_bin_string) {
                    matches += to_string(file)
                     }
             }
      }
}
print matches

FreeZEternal

Korea (South)3396 Posts

May 13 2008 20:02 GMT

is it just me or suddenly we have lots of programming questions. I would have done this in Java or Ruby.

MasterOfChaos

Germany2896 Posts

May 13 2008 20:33 GMT

for matching the signature you can use a simple binary safe StringPos function. If you want to code it yourself you can use sth like the following:

function CheckForSig(File:String;Sig:String);
var i,j:integer;
hit:boolean;
for i:=0 to length(file)-1 do
hit:=true;
for j:=0 to min(length(file)-1-i,length(sig)-1) do
if file[i+j]!=sig[j]then hit:=false;break;end;
end;
if hit then return true; end;
end;
return false;
end;

of cause that is not the fastest possible way of doing it, for a large signature set.

edit: Pos function used by Delphi (asmcode

)
+ Show Spoiler +

(* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1
*
* The implementation of function Pos is subject to the
* Mozilla Public License Version 1.1 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is Fastcode
*
* The Initial Developer of the Original Code is Fastcode
*
* Portions created by the Initial Developer are Copyright (C) 2002-2004
* the Initial Developer. All Rights Reserved.
*
* Contributor(s): Aleksandr Sharahov
*
* ***** END LICENSE BLOCK ***** *)
function Pos(const substr, str: AnsiString): Integer; overload;
asm
push ebx
push esi
add esp, -16
test edx, edx
jz @NotFound
test eax, eax
jz @NotFound
mov esi, [edx-4] //Length(Str)
mov ebx, [eax-4] //Length(Substr)
cmp esi, ebx
jl @NotFound
test ebx, ebx
jle @NotFound
dec ebx
add esi, edx
add edx, ebx
mov [esp+8], esi
add eax, ebx
mov [esp+4], edx
neg ebx
movzx ecx, byte ptr [eax]
mov [esp], ebx
jnz @FindString

sub esi, 2
mov [esp+12], esi

@FindChar2:
cmp cl, [edx]
jz @Matched0ch
cmp cl, [edx+1]
jz @Matched1ch
add edx, 2
cmp edx, [esp+12]
jb @FindChar4
cmp edx, [esp+8]
jb @FindChar2
@NotFound:
xor eax, eax
jmp @Exit0ch

@FindChar4:
cmp cl, [edx]
jz @Matched0ch
cmp cl, [edx+1]
jz @Matched1ch
cmp cl, [edx+2]
jz @Matched2ch
cmp cl, [edx+3]
jz @Matched3ch
add edx, 4
cmp edx, [esp+12]
jb @FindChar4
cmp edx, [esp+8]
jb @FindChar2
xor eax, eax
jmp @Exit0ch

@Matched2ch:
add edx, 2
@Matched0ch:
inc edx
mov eax, edx
sub eax, [esp+4]
@Exit0ch:
add esp, 16
pop esi
pop ebx
ret

@Matched3ch:
add edx, 2
@Matched1ch:
add edx, 2
xor eax, eax
cmp edx, [esp+8]
ja @Exit1ch
mov eax, edx
sub eax, [esp+4]
@Exit1ch:
add esp, 16
pop esi
pop ebx
ret

@FindString4:
cmp cl, [edx]
jz @Test0
cmp cl, [edx+1]
jz @Test1
cmp cl, [edx+2]
jz @Test2
cmp cl, [edx+3]
jz @Test3
add edx, 4
cmp edx, [esp+12]
jb @FindString4
cmp edx, [esp+8]
jb @FindString2
xor eax, eax
jmp @Exit1

@FindString:
sub esi, 2
mov [esp+12], esi
@FindString2:
cmp cl, [edx]
jz @Test0
@AfterTest0:
cmp cl, [edx+1]
jz @Test1
@AfterTest1:
add edx, 2
cmp edx, [esp+12]
jb @FindString4
cmp edx, [esp+8]
jb @FindString2
xor eax, eax
jmp @Exit1

@Test3:
add edx, 2
@Test1:
mov esi, [esp]
@Loop1:
movzx ebx, word ptr [esi+eax]
cmp bx, word ptr [esi+edx+1]
jnz @AfterTest1
add esi, 2
jl @Loop1
add edx, 2
xor eax, eax
cmp edx, [esp+8]
ja @Exit1
@RetCode1:
mov eax, edx
sub eax, [esp+4]
@Exit1:
add esp, 16
pop esi
pop ebx
ret

@Test2:
add edx,2
@Test0:
mov esi, [esp]
@Loop0:
movzx ebx, word ptr [esi+eax]
cmp bx, word ptr [esi+edx]
jnz @AfterTest0
add esi, 2
jl @Loop0
inc edx
@RetCode0:
mov eax, edx
sub eax, [esp+4]
add esp, 16
pop esi
pop ebx
end;

FreeZEternal

Korea (South)3396 Posts

May 13 2008 20:38 GMT

holy shit lol. Haven't seen asm for a long!!!!! time

LastWish

2013 Posts

May 13 2008 21:21 GMT

Use google to find examples on anything something like : "C++ find file".
And combine it together.

You may easily read the file into String (delphi, java or ruby, lil harder in C++) and use some substring or pos or whatever function.
Really easy task.

Delphi code :
use FindFirst and FindNext functions(see help)
use
S : String;
AssignFile(F,FileName);
SetLength(S,FileSize(F));
BlockRead(F, S[1], FileSize(F));
CloseFile(F);

use Pos function to find whether there is an appropriate match

yenta

Poland1142 Posts

May 13 2008 23:56 GMT

What you're describing can be written very simply in perl.

pseudo code:

@signatures = <SIGNATURE_FILE>
foreach $file in recursive_glob(PARENT_DIRECTORY) {
@contents = <$file>
foreach $chunk in @contents {
if $chunk in @signatures warn "virus"
}
}

just make sure you use binmode

Please or register to reply.

C++ project help

Completed

Ongoing

Upcoming