Clam AntiVirus: Signature Tool 1.4.6
By The ClamAV Team: https://www.clamav.net/about.html#credits
(C) 2024 Cisco Systems, Inc.
sigtool [options]
--help -h Show this help
--version -V Print version number and exit
--quiet Be quiet, output only error messages
--debug Enable debug messages
--stdout Write to stdout instead of stderr. Does not affect 'debug' messages.
--hex-dump Convert data from stdin to a hex
string and print it on stdout
--md5 [FILES] Generate MD5 checksum from stdin
or MD5 sigs for FILES
--sha1 [FILES] Generate SHA1 checksum from stdin
or SHA1 sigs for FILES
--sha256 [FILES] Generate SHA256 checksum from stdin
or SHA256 sigs for FILES
--mdb [FILES] Generate .mdb (section hash) sigs
--imp [FILES] Generate .imp (import table hash) sigs
--fuzzy-img FILE(S) Generate image fuzzy hash for each file
--html-normalise=FILE Create normalised parts of HTML file
--ascii-normalise=FILE Create normalised text file from ascii source
--utf16-decode=FILE Decode UTF16 encoded files
--info=FILE -i FILE Print database information
--build=NAME [cvd] -b NAME Build a CVD file
--max-bad-sigs=NUMBER Maximum number of mismatched signatures
When building a CVD. Default: 3000
--flevel=FLEVEL Specify a custom flevel.
Default: 216
--cvd-version=NUMBER Specify the version number to use for
the build. Default is to use the value+1
from the current CVD in --datadir.
If no datafile is found the default
behaviour is to prompt for a version
number, this switch will prevent the
prompt. NOTE: If a CVD is found in the
--datadir its version+1 is used and
this value is ignored.
--no-cdiff Don't generate .cdiff file
--unsigned Create unsigned database file (.cud)
--hybrid Create a hybrid (standard and bytecode) database file
--print-certs=FILE Print Authenticode details from a PE
--server=ADDR ClamAV Signing Service address
--datadir=DIR Use DIR as default database directory
--unpack=FILE -u FILE Unpack a CVD/CLD file
--unpack-current=SHORTNAME Unpack local CVD/CLD into cwd
--list-sigs[=FILE] -l[FILE] List signature names
--find-sigs=REGEX -fREGEX Find signatures matching REGEX
--decode-sigs Decode signatures from stdin
--test-sigs=DATABASE TARGET_FILE Test signatures from DATABASE against
TARGET_FILE
--vba=FILE Extract VBA/Word6 macro code
--vba-hex=FILE Extract Word6 macro code with hex values
--diff=OLD NEW -d OLD NEW Create diff for OLD and NEW CVDs
--compare=OLD NEW -c OLD NEW Show diff between OLD and NEW files in
cdiff format
--run-cdiff=FILE -r FILE Execute update script FILE in cwd
--verify-cdiff=DIFF CVD/CLD Verify DIFF against CVD/CLD
--tempdir=DIRECTORY Create temporary files in DIRECTORY
--leave-temps[=yes/no(*)] Do not remove temporary files
Options (40)
| Option | Description | Source |
|---|---|---|
--help, -h | Output help information and exit. | help + man |
--version, -V | -V Print version number and exit | help + man |
--quiet | Be quiet - output only error messages. | help + man |
--debug | Enable debug messages | help |
--stdout | Write to stdout instead of stderr. | help + man |
--hex-dump | Convert data from stdin to a hex string and print it on stdout | help + man |
--md5 FILES | Generate MD5 checksum from stdin or MD5 sigs for FILES | help |
--sha1 FILES | Generate SHA1 checksum from stdin or SHA1 sigs for FILES | help |
--sha256 FILES | Generate SHA256 checksum from stdin or SHA256 sigs for FILES | help |
--mdb FILES | Generate .mdb (section hash) sigs | help |
--imp FILES | Generate .imp (import table hash) sigs | help |
--fuzzy-img FILE(S) | Generate image fuzzy hash for each file | help |
--html-normalise FILE | Create normalised HTML files comment.html, nocomment.html, and script.html in current working directory. | help + man |
--ascii-normalise FILE | Create normalised text file from ascii source | help |
--utf16-decode FILE | Decode UTF16 encoded files | help + man |
--info, -i FILE | Print a CVD information and verify MD5 and a digital signature. | help + man |
--build, -b NAME | Build a CVD file. | help + man |
--max-bad-sigs NUMBER | Maximum number of mismatched signatures When building a CVD. | help + man |
--flevel FLEVEL | Specify a custom flevel. | help + man |
--cvd-version NUMBER | Specify the version number to use for the build. | help + man |
--no-cdiff | Don't create a .cdiff file when building a new database file. | help + man |
--unsigned | Create a database file without digital signatures (.cud). | help + man |
--hybrid | Create a hybrid (standard and bytecode) database file | help |
--print-certs FILE | Print Authenticode details from a PE file. | help + man |
--server ADDR | ClamAV Signing Service address (for virus database maintainers only). | help + man |
--datadir DIR | Use DIR as the default database directory for all operations. | help + man |
--unpack, -u FILE | Unpack FILE (CVD) to a current directory. | help + man |
--unpack-current SHORTNAME | Unpack a local CVD file (main or daily) to current directory. | help + man |
--list-sigs FILE | -l[FILE] List signature names | help |
--find-sigs, -fREGEX REGEX | Find and display signatures from the local database directory which match the given REGEX. | help + man |
--decode-sigs REGEX | Decode signatures read from the standard input (eg. | help + man |
--test-sigs DATABASE | Test all signatures from DATABASE against TARGET_FILE. | help + man |
--vba FILE | Extract VBA/Word6 macros from given MS Office document. | help + man |
--vba-hex FILE | Extract Word6 macros from given MS Office document and display the corresponding hex values. | help + man |
--diff, -d OLD | Create a diff file for OLD and NEW CVDs/INCDIRs. | help + man |
--compare, -c OLD | This command will compare two text files and print differences in a cdiff format. | help + man |
--run-cdiff, -r FILE | Execute update script FILE in current directory. | help + man |
--verify-cdiff DIFF | Verify DIFF against CVD/CLD | help |
--tempdir DIRECTORY | Create temporary files in DIRECTORY. | help + man |
--leave-temps yes/no(*) | Do not remove temporary files. | help + man |