sigtool(1)

NAME

sigtool - signature and database management tool

SYNOPSIS

sigtool [options]

DESCRIPTION

sigtool can be used to generate MD5 checksums, convert data into hexadecimal format, list virus signatures and build/unpack/test/verify CVD databases and update scripts.

COMMON OPTIONS

-h, --help
    Output help information and exit.

-V, --version
    Print version number and exit.

--quiet
    Be quiet, output only error messages.

--debug
    Enable debug messages

--stdout
    Write all messages to stdout.

--tempdir=DIRECTORY
    Create temporary files in DIRECTORY. Directory must be writable for the user running sigtool.

--leave-temps
    Do not remove temporary files.

--datadir=DIR
    Use DIR as the default database directory for all operations.

COMMANDS FOR WORKING WITH SIGNATURES

-l[FILE], --list-sigs[=FILE]
    List all signature names from the local database directory (default) or from FILE.

-fREGEX, --find-sigs=REGEX
    Find and display signatures from the local database directory which match the given REGEX. The whole signature body (name, hex string, etc.) is checked.

--decode-sigs=REGEX
    Decode signatures read from the standard input (eg. piped from --find-sigs)

--test-sigs=DATABASE TARGET_FILE
    Test all signatures from DATABASE against TARGET_FILE. This option will only give valid results if the target file is the final one (after unpacking, normalization, etc.) for which the signatures were created.

COMMANDS TO GENERATE SIGNATURES

--md5 [FILES]
    Generate MD5 checksum from stdin or MD5 sigs for FILES.

--sha1 [FILES]
    Generate SHA1 checksum from stdin or SHA1 sigs for FILES.

--sha2-256 [FILES]
    Generate SHA2-256 checksum from stdin or SHA2-256 sigs for FILES. The previous option --sha256 is deprecated and may be removed in a future version.

--mdb [FILES]
    Generate .mdb (PE section hash) signatures for FILES.

--imp [FILES]
    Generate .imp (PE import address table hash) signatures for FILES.

--fuzzy-img [FILES]
    Generate image fuzzy hash for each file.

COMMANDS TO NORMALIZE FILES

--html-normalise=FILE
    Create normalised HTML files comment.html, nocomment.html, and script.html in current working directory.

--ascii-normalise=FILE
    Create normalised text file from ascii source.

--utf16-decode=FILE
    Decode UTF16 encoded data.

COMMANDS FOR FILE ANALYSIS

--vba=FILE
    Extract VBA/Word6 macros from given MS Office document.

--vba-hex=FILE
    Extract Word6 macros from given MS Office document and display the corresponding hex values.

--print-certs=FILE
    Print Authenticode details from a PE file.

--hex-dump
    Read data from stdin and write hex string to stdout.

COMMANDS FOR WORKING WITH CVDS

-i, --info
    Print a CVD information and verify MD5 and a digital signature.

--build=FILE, -b FILE
    Build a CVD file. -s, --server is required for signed virus databases(.cvd), or, --unsigned for unsigned(.cud).

--max-bad-sigs=NUMBER
    Maximum number of mismatched signatures when building a CVD. Default: 3000

--flevel
    Specify a custom flevel. Default: 77

--cvd-version
    Specify the version number to use for the build. Default is to use the value+1 from the current CVD in --datadir. If no datafile is found the default behaviour is to prompt for a version number, this switch will prevent the prompt. NOTE: If a CVD is found in the --datadir its version+1 is used and this value is ignored.

--no-cdiff
    Don't create a .cdiff file when building a new database file.

--hybrid
    Create a hybrid (standard and bytecode) database file.

--unsigned
    Create a database file without digital signatures (.cud).

--server=ADDR
    ClamAV Signing Service address (for virus database maintainers only).

--unpack=FILE, -u FILE
    Unpack FILE (CVD) to a current directory.

--unpack-current
    Unpack a local CVD file (main or daily) to current directory.

--fips-limits
    Enforce FIPS-like limits on using hash algorithms for cryptographic purposes. Will disable MD5 & SHA1 FP sigs and will require '.sign' files to verify CVD authenticity.

COMMANDS FOR WORKING WITH CDIFF PATCH FILES

--diff=OLD NEW, -d OLD NEW
    Create a diff file for OLD and NEW CVDs/INCDIRs.

--compare=OLD NEW, -c OLD NEW
    This command will compare two text files and print differences in a cdiff format.

--run-cdiff=FILE, -r FILE
    Execute update script FILE in current directory.

--verify-cdiff=FILE, -r FILE
    Verify DIFF against CVD/INCDIR.

COMMANDS FOR CREATING AND VERIFYING DETACHED DIGITAL SIGNATURES

--sign
    Sign a file. The resulting .sign file name will be in the form: dbname-version.cvd.sign or FILE.sign for non-CVD targets. It will be created next to the target file. If a .sign file already exists, then the new signature will be appended to file.

--key=FILE
    Specify a signing key.

--cert=FILE
    Specify a signing cert. May be used more than once to add intermediate and root certificates.

--append
    Use to add a signature line to an existing .sign file. Otherwise an existing .sign file will be overwritten.

--verify
    Find and verify a detached digital signature for the given file. The digital signature file name must be in the form: dbname-version.cvd.sign or FILE.sign for non-CVD targets. It must be found next to the target file.

--cvdcertsdir=DIR
    Specify a directory containing the root CA cert needed to verify the signature. If not provided, then sigtool will look in the default certs directory.

ENVIRONMENT VARIABLES

Sigtool uses the following environment variables:

SIGNDUSER
    The username to authenticate with the signing server when building a signed CVD database.

SIGNDPASS
    The password to authenticate with the signing server when building a signed CVD database.

CVD_CERTS_DIR
    Specify a directory containing the root CA cert needed to verify detached CVD digital signatures. If not provided, then sigtool will look in the default directory.

EXAMPLES

Generate hex string from testfile and save it to testfile.hex:

    cat testfile | sigtool --hex-dump > testfile.hex

CREDITS
Please check the full documentation for credits.

AUTHOR

Tomasz Kojm <tkojm@clamav.net>

SEE ALSO

freshclam(1), freshclam.conf(5)