sigtool(1)

✨ sigtool — the Clam AntiVirus signature & database management tool, bestie edition ✨

okay so you found sigtool(1), the Clam AntiVirus one, and honestly? it's giving main character energy in the terminal. let me walk you through it 💅

---

🌸 NAME 🌸

sigtool — signature and database management tool. that's it, that's the vibe 🫶

---

🎀 SYNOPSIS 🎀

sigtool [options]

---

🦋 DESCRIPTION 🦋

bestie. sigtool does so much. lowkey it's the swiss army knife of the ClamAV world. here's the whole list, no cap:

• generate MD5 checksums
• convert data into hexadecimal format
• list virus signatures
• build / unpack / test / verify CVD databases
• build / unpack / test / verify update scripts

periodt. that's the job 💖

---

💜 COMMON OPTIONS 💜

the little settings that apply to basically everything:

• -h, --help — prints help info and dips out. bye 👋
• -V, --version — prints the version number and exits.
• --quiet — be quiet, queen. only error messages get to speak.
• --debug — turn on debug messages, for when you need to see everything 🔍
• --stdout — write all messages to stdout.
• --tempdir=DIRECTORY — create temporary files in DIRECTORY. heads up: that directory must be writable by the user running sigtool, or it's not gonna work 😭
• --leave-temps — do NOT remove temporary files. they stay. they linger. they're part of the family now 🙈
• --datadir=DIR — use DIR as the default database directory for all operations.

---

🔥 COMMANDS FOR WORKING WITH SIGNATURES 🔥

• -l[FILE], --list-sigs[=FILE] — list all signature names, either from the local database directory (that's the default) or from FILE.
• -fREGEX, --find-sigs=REGEX — find and display signatures from the local database directory that match the given REGEX. it checks the whole signature body — name, hex string, the entire thing, all of it 💅
• --decode-sigs=REGEX — decode signatures read from standard input (like, say, piped in from --find-sigs).
• --test-sigs=DATABASE TARGET_FILE — test all signatures from DATABASE against TARGET_FILE.

⚠️ real talk: this one only gives valid results if the target file is the final one — meaning after unpacking, normalization, etc. — the exact file the signatures were made for. otherwise the results are basically nonsense, ngl.

---

🌈 COMMANDS TO GENERATE SIGNATURES 🌈

• --md5 [FILES] — generate an MD5 checksum from stdin, or MD5 sigs for FILES.
• --sha1 [FILES] — generate a SHA1 checksum from stdin, or SHA1 sigs for FILES.
• --sha2-256 [FILES] — generate a SHA2-256 checksum from stdin, or SHA2-256 sigs for FILES.

💀 heads up bestie: the previous option --sha256 is deprecated and may be removed in a future version. don't get attached.

• --mdb [FILES] — generate .mdb (PE section hash) signatures for FILES.
• --imp [FILES] — generate .imp (PE import address table hash) signatures for FILES.
• --fuzzy-img [FILES] — generate image fuzzy hash for each file. fuzzy wuzzy 🧚

---

🍓 COMMANDS TO NORMALIZE FILES 🍓

• --html-normalise=FILE — create normalised HTML files comment.html, nocomment.html, and script.html in the current working directory. three files, one command, slay.
• --ascii-normalise=FILE — create a normalised text file from an ascii source.
• --utf16-decode=FILE — decode UTF16 encoded data.

---

👑 COMMANDS FOR FILE ANALYSIS 👑

• --vba=FILE — extract VBA/Word6 macros from the given MS Office document.
• --vba-hex=FILE — extract Word6 macros from the given MS Office document and display the corresponding hex values.
• --print-certs=FILE — print Authenticode details from a PE file.
• --hex-dump — read data from stdin and write the hex string to stdout.

---

💖 COMMANDS FOR WORKING WITH CVDS 💖

• -i, --info — print a CVD information and verify MD5 and a digital signature.
• --build=FILE, -b FILE — build a CVD file. note: -s, --server is required for signed virus databases (.cvd), or --unsigned for unsigned (.cud).
• --max-bad-sigs=NUMBER — maximum number of mismatched signatures when building a CVD. default: 3000
• --flevel — specify a custom flevel. default: 77
• --cvd-version — specify the version number to use for the build. the default is to use the value+1 from the current CVD in --datadir. if no datafile is found, the default behaviour is to prompt for a version number — this switch will prevent the prompt.

⚠️ NOTE: if a CVD is found in the --datadir, its version+1 is used and this value is ignored. so like, don't fight it.

• --no-cdiff — don't create a .cdiff file when building a new database file.
• --hybrid — create a hybrid (standard and bytecode) database file.
• --unsigned — create a database file without digital signatures (.cud).
• --server=ADDR — ClamAV Signing Service address (for virus database maintainers only, iykyk 🔐).
• --unpack=FILE, -u FILE — unpack FILE (CVD) to the current directory.
• --unpack-current — unpack a local CVD file (main or daily) to the current directory.
• --fips-limits — enforce FIPS-like limits on using hash algorithms for cryptographic purposes. this will disable MD5 & SHA1 FP sigs and will require .sign files to verify CVD authenticity.

---

🧚 COMMANDS FOR WORKING WITH CDIFF PATCH FILES 🧚

• --diff=OLD NEW, -d OLD NEW — create a diff file for OLD and NEW CVDs/INCDIRs.
• --compare=OLD NEW, -c OLD NEW — compare two text files and print the differences in a cdiff format.
• --run-cdiff=FILE, -r FILE — execute update script FILE in the current directory.
• --verify-cdiff=FILE, -r FILE — verify DIFF against CVD/INCDIR.

---

🎀 COMMANDS FOR CREATING AND VERIFYING DETACHED DIGITAL SIGNATURES 🎀

• --sign — sign a file. the resulting .sign file name will be in the form: dbname-version.cvd.sign or FILE.sign for non-CVD targets. it will be created next to the target file. and if a .sign file already exists, then the new signature will be appended to the file.
• --key=FILE — specify a signing key.
• --cert=FILE — specify a signing cert. may be used more than once to add intermediate and root certificates.
• --append — use to add a signature line to an existing .sign file. otherwise an existing .sign file will be overwritten. choose wisely 💅
• --verify — find and verify a detached digital signature for the given file. the digital signature file name must be in the form: dbname-version.cvd.sign or FILE.sign for non-CVD targets. it must be found next to the target file.
• --cvdcertsdir=DIR — specify a directory containing the root CA cert needed to verify the signature. if not provided, then sigtool will look in the default certs directory.

---

🌸 ENVIRONMENT VARIABLES 🌸

sigtool uses the following environment variables:

• SIGNDUSER — the username to authenticate with the signing server when building a signed CVD database.
• SIGNDPASS — the password to authenticate with the signing server when building a signed CVD database.
• CVD_CERTS_DIR — specify a directory containing the root CA cert needed to verify detached CVD digital signatures. if not provided, then sigtool will look in the default directory.

---

⭐ EXAMPLES ⭐

generate a hex string from testfile and save it to testfile.hex:

cat testfile | sigtool --hex-dump > testfile.hex

look at that pipe. iconic. 🔥

---

💜 CREDITS 💜

please check the full documentation for credits 🫶

---

🦋 AUTHOR 🦋

Tomasz Kojm <tkojm@clamav.net>

---

🌈 SEE ALSO 🌈

freshclam(1), freshclam.conf(5)

---

and that's the whole page, bestie — this was ClamAV 1.5.4, dated February 12, 2007 🎀 thanks for reading, you ate, go build a CVD or something 💖✨