libsigscan(3)

✨ NAME ✨

okay so welcome to libsigscan(3) — yes that's the man page name, and it lives in the Library Functions Manual, iykyk 💅 — and it's all about libsigscan.h, the Library for binary signature scanning. that's the whole vibe, bestie: signatures, scanned, binarically. 🦋

---

🎀 SYNOPSIS 🎀

include it like the icon it is:

#include <libsigscan.h>

💖 Support functions

const char *
libsigscan_get_version(void);

int
libsigscan_get_access_flags_read(void);

int
libsigscan_get_codepage(int *codepage, libsigscan_error_t **error);

int
libsigscan_set_codepage(int codepage, libsigscan_error_t **error);

the support squad 🫶 — version getting, access flags reading, codepage getting and setting. lowkey the backbone of the whole operation.

🌸 Notify functions

void
libsigscan_notify_set_verbose(int verbose);

int
libsigscan_notify_set_stream(FILE *stream, libsigscan_error_t **error);

int
libsigscan_notify_stream_open(const char *filename,
    libsigscan_error_t **error);

int
libsigscan_notify_stream_close(libsigscan_error_t **error);

the notify girlies — set verbose, set stream, open stream, close stream. very "talk to me, tell me everything" energy. 💬

🌈 Error functions

void
libsigscan_error_free(libsigscan_error_t **error);

int
libsigscan_error_fprint(libsigscan_error_t *error, FILE *stream);

int
libsigscan_error_sprint(libsigscan_error_t *error, char *string,
    size_t size);

int
libsigscan_error_backtrace_fprint(libsigscan_error_t *error,
    FILE *stream);

int
libsigscan_error_backtrace_sprint(libsigscan_error_t *error,
    char *string, size_t size);

when things go wrong, these are the ones holding your hand 😭 — free, fprint, sprint, and the backtrace versions of fprint and sprint too, because sometimes you need to know how you got here. main character detective energy. 🔍

👑 Scanner functions

int
libsigscan_scanner_initialize(libsigscan_scanner_t **scanner,
    libsigscan_error_t **error);

int
libsigscan_scanner_free(libsigscan_scanner_t **scanner,
    libsigscan_error_t **error);

int
libsigscan_scanner_signal_abort(libsigscan_scanner_t *scanner,
    libsigscan_error_t **error);

int
libsigscan_scanner_set_scan_buffer_size(libsigscan_scanner_t *scanner,
    size_t scan_buffer_size, libsigscan_error_t **error);

int
libsigscan_scanner_add_signature(libsigscan_scanner_t *scanner,
    const char *identifier, size_t identifier_length,
    off64_t pattern_offset, const uint8_t *pattern, size_t pattern_size,
    uint32_t signature_flags, libsigscan_error_t **error);

int
libsigscan_scanner_scan_start(libsigscan_scanner_t *scanner,
    libsigscan_scan_state_t *scan_state, libsigscan_error_t **error);

int
libsigscan_scanner_scan_stop(libsigscan_scanner_t *scanner,
    libsigscan_scan_state_t *scan_state, libsigscan_error_t **error);

int
libsigscan_scanner_scan_buffer(libsigscan_scanner_t *scanner,
    libsigscan_scan_state_t *scan_state, const uint8_t *buffer,
    size_t buffer_size, libsigscan_error_t **error);

int
libsigscan_scanner_scan_file(libsigscan_scanner_t *scanner,
    libsigscan_scan_state_t *scan_state, const char *filename,
    libsigscan_error_t **error);

this is the whole moment ✨ initialize it, free it, signal an abort, set the scan buffer size, add_signature with its identifier, identifier_length, pattern_offset, pattern, pattern_size and signature_flags, then scan_start, scan_stop, scan_buffer, scan_file. periodt. 💅

Available when compiled with wide character string support:

int
libsigscan_scanner_scan_file_wide(libsigscan_scanner_t *scanner,
    libsigscan_scan_state_t *scan_state, const wchar_t *filename,
    libsigscan_error_t **error);

Available when compiled with libbfio support:

int
libsigscan_scanner_scan_file_io_handle(libsigscan_scanner_t *scanner,
    libsigscan_scan_state_t *scan_state,
    libbfio_handle_t *file_io_handle, libsigscan_error_t **error);

bestie listen — those last two? conditional. only there if you built with wide character string support, or with libbfio support respectively. don't come for them if they're not in your build. 🙈

🧚 Scan state functions

int
libsigscan_scan_state_initialize(libsigscan_scan_state_t **scan_state,
    libsigscan_error_t **error);

int
libsigscan_scan_state_free(libsigscan_scan_state_t **scan_state,
    libsigscan_error_t **error);

int
libsigscan_scan_state_set_data_size(libsigscan_scan_state_t *scan_state,
    size64_t data_size, libsigscan_error_t **error);

int
libsigscan_scan_state_get_number_of_results(libsigscan_scan_state_t *scan_state,
    int *number_of_results, libsigscan_error_t **error);

int
libsigscan_scan_state_get_result(libsigscan_scan_state_t *scan_state,
    int result_index, libsigscan_scan_result_t **scan_result,
    libsigscan_error_t **error);

initialize, free, set data size, get the number of results, get a result by result_index and hand you back a libsigscan_scan_result_t **scan_result. the receipts section 📋

🍓 Scan result functions

int
libsigscan_scan_result_free(libsigscan_scan_result_t **scan_result,
    libsigscan_error_t **error);

int
libsigscan_scan_result_get_identifier_size(libsigscan_scan_result_t *scan_result,
    size_t *identifier_size, libsigscan_error_t **error);

int
libsigscan_scan_result_get_identifier(libsigscan_scan_result_t *scan_result,
    char *identifier, size_t identifier_size,
    libsigscan_error_t **error);

free the result, get the identifier size, get the identifier itself with the identifier buffer and its identifier_size. that's the whole arc, bestie. 🫶

---

💜 DESCRIPTION 💜

so here's the thing: libsigscan_get_version() is the function you call to retrieve the library version. that's it, that's the description. short king of a section. ngl, iconic of it to say so much with so little. 👑

---

😭 RETURN VALUES 😭

most of the functions return NULL or -1 on error — depends on the return type, fr fr. for the actual return values, go look at libsigscan.h. don't guess, bestie, the answers are right there. 📖

---

💀 ENVIRONMENT 💀

None.

that's it. that's the section. absolutely nothing. no cap. an empty plate, a clean slate, a vibe with zero baggage. 🎀

---

🦋 FILES 🦋

libsigscan allows to be compiled with wide character support (wchar_t).

to compile libsigscan with wide character support, use:

./configure --enable-wide-character-type=yes

or define: _UNICODE or UNICODE during compilation.

LIBSIGSCAN_WIDE_CHARACTER_TYPE in libsigscan/features.h can be used to determine if libsigscan was compiled with wide character support.

so if you're sitting there like "wait, did my build get the wide char glow-up?" — that macro in that header is your answer. 🌟

---

🐛 BUGS 🐛

please report bugs of any kind on the project issue tracker:

https://github.com/libyal/libsigscan/issues

(any kind. ANY. we want them all, don't be shy 💌)

---

✍️ AUTHOR ✍️

these man pages are generated from libsigscan.h.

---

⭐ COPYRIGHT ⭐

Copyright (C) 2014-2024, Joachim Metz <joachim.metz@gmail.com>.

this is free software; see the source for copying conditions. there is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

say it with me: NO WARRANTY. not for MERCHANTABILITY, not for FITNESS FOR A PARTICULAR PURPOSE, not for your situationship. 💅

---

👀 SEE ALSO 👀

• the libsigscan.h include file

---

and that's the whole page bestie!! 🩷 this was libsigscan — the source/version tag — from May 3, 2019, and the manual you just read is the libsigscan(3) one, the Library Functions Manual flavor. go scan some binaries, you absolute legend. mwah. 💖✨🎀