Product SiteDocumentation Site

Appendix A. Riešenia/Solutions

A.1. Antivírusový skener / Antivirus scanner

/* 
  Jednoduchy antivirusovy skener
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <unistd.h>
#include <dirent.h>
#include <elf.h>
#include <fcntl.h>
#include <pwd.h>

//identifikator infikovanosti
#define MAGIC 6585
#define MAX_BUF 1024

static int magic = MAGIC;

//infikovanie suboru virusu
int detect(char *filename, int hd)
{
    //handle pre docasny subor
   int fd;
   //info subore
   struct stat stat;
   char *data;
   char tmpfile[MAX_BUF];
   char cmd[MAX_BUF]="\0";
   int tmagic;	  // Store files magic number
   int magicloc;  // Location of magic number
   Elf32_Ehdr ehdr;


/* kontrola magic(identifikator virusu) na konci suboru */
   if(fstat(hd, &stat) < 0) return 1;
   magicloc = stat.st_size - sizeof(magic);
   if( lseek(hd, magicloc, SEEK_SET) != magicloc ) return 1;

   //nacitanie magic znaku, infikovanosti
   if(read(hd, &tmagic, sizeof(magic)) != sizeof(magic)) return 1;
   //ak je subor infikovany, znova neinfikuje
   if(tmagic == MAGIC) return 2;
   if(lseek(hd, 0, SEEK_SET) != 0) exit(1);


   return 0;
}

//prehladanie aktualneho suboru na spustitelne subory typu ELF
void scan_dir(char *directory)
{
   int hd;
   int r;
   DIR *dd;
   struct dirent *dirp;
   char vfile[256];
 
   /* otvorenie adresara */
   dd = opendir(directory);
   
   // prehladanie celeho adresara 
   
   if(dirp != NULL) {
	while (dirp = readdir(dd)) 
	{
	r=0;
	strncpy(vfile, directory, 255);
	strcat(vfile, "/");
	strncat(vfile, dirp->d_name, 255-strlen(vfile));
	    hd=open(vfile, O_RDONLY, 0);
	    if(hd >= 0) {
		    r=detect(vfile, hd);
		    if (r==2)
			printf("Subor infikovany: %s\n",vfile);
		}
	    close(hd);
	}
	closedir(dd);
   }
   
}


int main(int argc, char *argv[], char *envp[])
{
  
   if (argc < 2) {
   	printf("Pouzitie %s adresar\n",argv[0]);
	exit(1);
   }
   printf("Prehladavam adresar %s\n",argv[1]); 
   //prehladanie adresara
   scan_dir(argv[1]);
   return 0;
}