Executive summary
ClamAV Signature Creator (CASC) is an IDA Pro plugin that assists in the creation of ClamAV pattern signatures. We have enhanced this plugin to also analyze these signatures. The plugin highlights matching parts in a binary when its given a particular signature. This function is helpful when evaluating automatically generated signatures, e.g., from the BASS framework. As a larger number of signatures is automatically generated, it becomes ever more important to gain a quick understanding about the effects of these signatures. This functionality will allow us to check the accuracy of our signatures faster, and allow us to deliver a better product to our users.
Description
The signature analysis function integrates neatly into the existing CASC plugin. Because the signature analyzer (“SigAnalyzer”) function needs some extra libraries, the installation of the plugin changes slightly — you can install the library dependencies via your distribution if you use the system Python (e.g., on Linux on a 32-bit machine for any IDA version or on Linux with IDA 7.0 on a 64-bit machine), or you can use the provided ZIP archives with bundled library dependencies. Detailed installation instructions for both cases can be found in the project’s README.
If the library dependencies are satisfied, you’ll have a new tab “Analyze” next to the tab “Create” in the plugin’s pane. Here, you can paste a logical signature (ldb) or pattern signature (ndb), and press “Add signature.” The signature will appear in the “Signatures” list above if it parsed correctly. If nothing happens, keep an eye on error messages in IDA’s output window. Now you can double-click the signature in the list. For an ndb signature, this will directly take you to the match in the IDA-View window. The match is green-colored.
An ldb signature will show all sub-signatures on the right list instead. You can double-click on a sub-signature, and it will color the match and bring you to it. Keep an eye on the text row above the “Add signature” button — you can find more information on the match there, or a message if there is no match. Added signatures are stored inside the database, and will be available again in the signature selection window the next time you open the database.
Internally, the plugin relies on Yara-python to find matches. ClamAV signatures are translated to Yara rules, which are then matched against the binary data. The plugin’s source code is available on our GitHub page, as well as in installation packages for your convenience. Please go ahead and test the new functionality, but keep in mind that the functionality is in an early beta stage, and still may have a bug or two. If you come across a bug, or you want to comment, please don't hesitate to let us know through a GitHub issue.
We are excited to have our users use this new feature. Please continue to follow along on the blog for new ClamAV features as we develop them, and be sure to follow us on Twitter.
We are excited to have our users use this new feature. Please continue to follow along on the blog for new ClamAV features as we develop them, and be sure to follow us on Twitter.
