Clam AntiVirus: Signature Tool 1.4.3
By The ClamAV Team: https://www.clamav.net/about.html#credits
(C) 2024 Cisco Systems, Inc.
sigtool [options]
--help -h Show this help
--version -V Print version number and exit
--quiet Be quiet, output only error messages
--debug Enable debug messages
--stdout Write to stdout instead of stderr. Does not affect 'debug' messages.
--hex-dump Convert data from stdin to a hex
string and print it on stdout
--md5 [FILES] Generate MD5 checksum from stdin
or MD5 sigs for FILES
--sha1 [FILES] Generate SHA1 checksum from stdin
or SHA1 sigs for FILES
--sha256 [FILES] Generate SHA256 checksum from stdin
or SHA256 sigs for FILES
--mdb [FILES] Generate .mdb (section hash) sigs
--imp [FILES] Generate .imp (import table hash) sigs
--fuzzy-img FILE(S) Generate image fuzzy hash for each file
--html-normalise=FILE Create normalised parts of HTML file
--ascii-normalise=FILE Create normalised text file from ascii source
--utf16-decode=FILE Decode UTF16 encoded files
--info=FILE -i FILE Print database information
--build=NAME [cvd] -b NAME Build a CVD file
--max-bad-sigs=NUMBER Maximum number of mismatched signatures
When building a CVD. Default: 3000
--flevel=FLEVEL Specify a custom flevel.
Default: 213
--cvd-version=NUMBER Specify the version number to use for
the build. Default is to use the value+1
from the current CVD in --datadir.
If no datafile is found the default
behaviour is to prompt for a version
number, this switch will prevent the
prompt. NOTE: If a CVD is found in the
--datadir its version+1 is used and
this value is ignored.
--no-cdiff Don't generate .cdiff file
--unsigned Create unsigned database file (.cud)
--hybrid Create a hybrid (standard and bytecode) database file
--print-certs=FILE Print Authenticode details from a PE
--server=ADDR ClamAV Signing Service address
--datadir=DIR Use DIR as default database directory
--unpack=FILE -u FILE Unpack a CVD/CLD file
--unpack-current=SHORTNAME Unpack local CVD/CLD into cwd
--list-sigs[=FILE] -l[FILE] List signature names
--find-sigs=REGEX -fREGEX Find signatures matching REGEX
--decode-sigs Decode signatures from stdin
--test-sigs=DATABASE TARGET_FILE Test signatures from DATABASE against
TARGET_FILE
--vba=FILE Extract VBA/Word6 macro code
--vba-hex=FILE Extract Word6 macro code with hex values
--diff=OLD NEW -d OLD NEW Create diff for OLD and NEW CVDs
--compare=OLD NEW -c OLD NEW Show diff between OLD and NEW files in
cdiff format
--run-cdiff=FILE -r FILE Execute update script FILE in cwd
--verify-cdiff=DIFF CVD/CLD Verify DIFF against CVD/CLD
--tempdir=DIRECTORY Create temporary files in DIRECTORY
--leave-temps[=yes/no(*)] Do not remove temporary files
Options (40)
| Option | Description | Source |
|---|---|---|
--help | -h Show this help | help |
--version | -V Print version number and exit | help |
--quiet | Be quiet, output only error messages | help |
--debug | Enable debug messages | help |
--stdout | Write to stdout instead of stderr. | help |
--hex-dump | Convert data from stdin to a hex string and print it on stdout | help |
--md5 FILES | Generate MD5 checksum from stdin or MD5 sigs for FILES | help |
--sha1 FILES | Generate SHA1 checksum from stdin or SHA1 sigs for FILES | help |
--sha256 FILES | Generate SHA256 checksum from stdin or SHA256 sigs for FILES | help |
--mdb FILES | Generate .mdb (section hash) sigs | help |
--imp FILES | Generate .imp (import table hash) sigs | help |
--fuzzy-img FILE(S) | Generate image fuzzy hash for each file | help |
--html-normalise FILE | Create normalised parts of HTML file | help |
--ascii-normalise FILE | Create normalised text file from ascii source | help |
--utf16-decode FILE | Decode UTF16 encoded files | help |
--info FILE | -i FILE Print database information | help |
--build NAME | Build a CVD file | help |
--max-bad-sigs NUMBER | Maximum number of mismatched signatures When building a CVD. | help |
--flevel FLEVEL | Specify a custom flevel. | help |
--cvd-version NUMBER | Specify the version number to use for the build. | help |
--no-cdiff | Don't generate .cdiff file | help |
--unsigned | Create unsigned database file (.cud) | help |
--hybrid | Create a hybrid (standard and bytecode) database file | help |
--print-certs FILE | Print Authenticode details from a PE | help |
--server ADDR | ClamAV Signing Service address | help |
--datadir DIR | Use DIR as default database directory | help |
--unpack FILE | -u FILE Unpack a CVD/CLD file | help |
--unpack-current SHORTNAME | Unpack local CVD/CLD into cwd | help |
--list-sigs FILE | -l[FILE] List signature names | help |
--find-sigs REGEX | -fREGEX Find signatures matching REGEX | help |
--decode-sigs | Decode signatures from stdin | help |
--test-sigs DATABASE | Test signatures from DATABASE against TARGET_FILE | help |
--vba FILE | Extract VBA/Word6 macro code | help |
--vba-hex FILE | Extract Word6 macro code with hex values | help |
--diff OLD | -d OLD NEW Create diff for OLD and NEW CVDs | help |
--compare OLD | -c OLD NEW Show diff between OLD and NEW files in cdiff format | help |
--run-cdiff FILE | -r FILE Execute update script FILE in cwd | help |
--verify-cdiff DIFF | Verify DIFF against CVD/CLD | help |
--tempdir DIRECTORY | Create temporary files in DIRECTORY | help |
--leave-temps yes/no(*) | Do not remove temporary files | help |