sigtool(1) Clam AntiVirus sigtool(1)

# [NAME](#NAME)

sigtool - signature and database management tool

# [SYNOPSIS](#SYNOPSIS)

sigtool \[options]

# [DESCRIPTION](#DESCRIPTION)

sigtool can be used to generate MD5 checksums, convert data into hexadecimal format, list virus signatures and build/unpack/test/verify CVD databases and update scripts.

# [COMMON OPTIONS](#COMMON_OPTIONS)

[**-h, --help**](#h,)

Output help information and exit.

[**-V, --version**](#V,)

Print version number and exit.

[**--quiet**](#quiet)

Be quiet, output only error messages.

[**--debug**](#debug)

Enable debug messages

[**--stdout**](#stdout)

Write all messages to stdout.

[**--tempdir=DIRECTORY**](#tempdir=DIRECTORY)

Create temporary files in DIRECTORY. Directory must be writable for the user running sigtool.

[**--leave-temps**](#leave)

Do not remove temporary files.

[**--datadir=DIR**](#datadir=DIR)

Use DIR as the default database directory for all operations.

# [COMMANDS FOR WORKING WITH SIGNATURES](#COMMANDS_FOR_WORKING_WITH_SIGNATURES)

[**-l\[FILE\], --list-sigs\[=FILE\]**](#l_FILE_,)

List all signature names from the local database directory (default) or from FILE.

[**-fREGEX, --find-sigs=REGEX**](#fREGEX,)

Find and display signatures from the local database directory which match the given REGEX. The whole signature body (name, hex string, etc.) is checked.

[**--decode-sigs=REGEX**](#decode)

Decode signatures read from the standard input (eg. piped from --find-sigs)

[**--test-sigs=DATABASE TARGET\_FILE**](#test)

Test all signatures from DATABASE against TARGET\_FILE. This option will only give valid results if the target file is the final one (after unpacking, normalization, etc.) for which the signatures were created.

# [COMMANDS TO GENERATE SIGNATURES](#COMMANDS_TO_GENERATE_SIGNATURES)

[**--md5 \[FILES\]**](#md5)

Generate MD5 checksum from stdin or MD5 sigs for FILES.

[**--sha1 \[FILES\]**](#sha1)

Generate SHA1 checksum from stdin or SHA1 sigs for FILES.

[**--sha2-256 \[FILES\]**](#sha2-256)

Generate SHA2-256 checksum from stdin or SHA2-256 sigs for FILES. The previous option --sha256 is deprecated and may be removed in a future version.

[**--mdb \[FILES\]**](#mdb)

Generate .mdb (PE section hash) signatures for FILES.

[**--imp \[FILES\]**](#imp)

Generate .imp (PE import address table hash) signatures for FILES.

[**--fuzzy-img \[FILES\]**](#fuzzy)

Generate image fuzzy hash for each file.

# [COMMANDS TO NORMALIZE FILES](#COMMANDS_TO_NORMALIZE_FILES)

[**--html-normalise=FILE**](#html)

Create normalised HTML files comment.html, nocomment.html, and script.html in current working directory.

[**--ascii-normalise=FILE**](#ascii)

Create normalised text file from ascii source.

[**--utf16-decode=FILE**](#utf16)

Decode UTF16 encoded data.

# [COMMANDS FOR FILE ANALYSIS](#COMMANDS_FOR_FILE_ANALYSIS)

[**--vba=FILE**](#vba=FILE)

Extract VBA/Word6 macros from given MS Office document.

[**--vba-hex=FILE**](#vba)

Extract Word6 macros from given MS Office document and display the corresponding hex values.

[**--print-certs=FILE**](#print)

Print Authenticode details from a PE file.

[**--hex-dump**](#hex)

Read data from stdin and write hex string to stdout.

# [COMMANDS FOR WORKING WITH CVDS](#COMMANDS_FOR_WORKING_WITH_CVDS)

[**-i, --info**](#i,)

Print a CVD information and verify MD5 and a digital signature.

[**--build=FILE, -b FILE**](#build=FILE,)

Build a CVD file. -s, --server is required for signed virus databases(.cvd), or, --unsigned for unsigned(.cud).

[**--max-bad-sigs=NUMBER**](#max)

Maximum number of mismatched signatures when building a CVD. Default: 3000

[**--flevel**](#flevel)

Specify a custom flevel. Default: 77

[**--cvd-version**](#cvd)

Specify the version number to use for the build. Default is to use the value+1 from the current CVD in --datadir. If no datafile is found the default behaviour is to prompt for a version number, this switch will prevent the prompt. NOTE: If a CVD is found in the --datadir its version+1 is used and this value is ignored.

[**--no-cdiff**](#no)

Don't create a .cdiff file when building a new database file.

[**--hybrid**](#hybrid)

Create a hybrid (standard and bytecode) database file.

[**--unsigned**](#unsigned)

Create a database file without digital signatures (.cud).

[**--server=ADDR**](#server=ADDR)

ClamAV Signing Service address (for virus database maintainers only).

[**--unpack=FILE, -u FILE**](#unpack=FILE,)

Unpack FILE (CVD) to a current directory.

[**--unpack-current**](#unpack)

Unpack a local CVD file (main or daily) to current directory.

[**--fips-limits**](#fips)

Enforce FIPS-like limits on using hash algorithms for cryptographic purposes. Will disable MD5 & SHA1 FP sigs and will require '.sign' files to verify CVD authenticity.

# [COMMANDS FOR WORKING WITH CDIFF PATCH FILES](#COMMANDS_FOR_WORKING_WITH_CDIFF_PATCH_FILES)

[**--diff=OLD NEW, -d OLD NEW**](#diff=OLD)

Create a diff file for OLD and NEW CVDs/INCDIRs.

[**--compare=OLD NEW, -c OLD NEW**](#compare=OLD)

This command will compare two text files and print differences in a cdiff format.

[**--run-cdiff=FILE, -r FILE**](#run)

Execute update script FILE in current directory.

[**--verify-cdiff=FILE, -r FILE**](#verify)

Verify DIFF against CVD/INCDIR.

# [COMMANDS FOR CREATING AND VERIFYING DETACHED DIGITAL SIGNATURES](#COMMANDS_FOR_CREATING_AND_VERIFYING_DETACHED_DIGITAL_SIGNATURES)

[**--sign**](#sign)

Sign a file. The resulting .sign file name will be in the form: dbname-version.cvd.sign or FILE.sign for non-CVD targets. It will be created next to the target file. If a .sign file already exists, then the new signature will be appended to file.

[**--key=FILE**](#key=FILE)

Specify a signing key.

[**--cert=FILE**](#cert=FILE)

Specify a signing cert. May be used more than once to add intermediate and root certificates.

[**--append**](#append)

Use to add a signature line to an existing .sign file. Otherwise an existing .sign file will be overwritten.

[**--verify**](#verify~2)

Find and verify a detached digital signature for the given file. The digital signature file name must be in the form: dbname-version.cvd.sign or FILE.sign for non-CVD targets. It must be found next to the target file.

[**--cvdcertsdir=DIR**](#cvdcertsdir=DIR)

Specify a directory containing the root CA cert needed to verify the signature. If not provided, then sigtool will look in the default certs directory.

# [ENVIRONMENT VARIABLES](#ENVIRONMENT_VARIABLES)

Sigtool uses the following environment variables:

[**SIGNDUSER**](#SIGNDUSER)

The username to authenticate with the signing server when building a signed CVD database.

[**SIGNDPASS**](#SIGNDPASS)

The password to authenticate with the signing server when building a signed CVD database.

[**CVD\_CERTS\_DIR**](#CVD_CERTS_DIR)

Specify a directory containing the root CA cert needed to verify detached CVD digital signatures. If not provided, then sigtool will look in the default directory.

# [EXAMPLES](#EXAMPLES)

[Generate hex string from testfile and save it to testfile.hex:](#Generate)

**cat testfile | sigtool --hex-dump > testfile.hex**

# [CREDITS](#CREDITS)

Please check the full documentation for credits.

# [AUTHOR](#AUTHOR)

Tomasz Kojm <tkojm@clamav.net>

# [SEE ALSO](#SEE_ALSO)

[freshclam(1)](/man/enterprise-packages/clamav-1.5/freshclam.1), [freshclam.conf(5)](/man/enterprise-packages/clamav-1.5/freshclam.conf.5)

February 12, 2007 ClamAV 1.5.4

---

Document: sigtool(1) from clamav-1.5 1.5.4-r5 (Chainguard OS)
Source: https://github.com/Cisco-Talos/clamav