如何编写防病毒签名数据库？
我用 C 编写了一些小代码来扫描所有文件&我的硬盘驱动器中的文件夹...它还可以读取可执行文件（如 .exe ）的二进制代码的上部，并将其与内联单个二进制签名（以十六进制表示形式）进行比较。如果签名与任何扫描文件的 bin 代码匹配，它会显示一条消息。
我们注意到我将示例签名保存在一个数组中，因为它只是一个签名。 如果我想添加很多其他签名，我必须做什么！我需要使用数据库！但我需要什么样的数据库？我是否需要使用 SQL 查询来获取和比较签名！商业防病毒软件（卡巴斯基、Symantic 等）使用哪种数据库？ 有什么想法吗？
i wrote small code in C to scan all files & folders in my hard drive... and it also can read the upper part of the binary code of executable files (like .exe ) and compare it with an inline single binary signature (in hexadecimal representation) . It can show a message if the signature matches the bin code of any scanned file.
We notice that i saved the sample signature in an array because it is just one signature.
What i have to do if i want to add lots of other signatures! I need to use a database! But what kind of database do i need? and shall i need to use SQL query to get and compare the signatures! what kind of database do the commercial antiviruses (Kaspersky, Symantic, ..etc) use?
any idea plz?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Berkeley DB 是一个免费/开源嵌入式数据库库这基本上是磁盘上的键值存储（搜索树或哈希表，取决于设置）。它甚至比 SQLite 更简单，因为它避免了关系数据和 SQL 的概念。
例如，您可以使用病毒签名作为键，将其名称作为值。
Berkeley DB is a free/open source embedded database library that is basically a key-value store on disk (search tree or hash table, depending on settings). It's even simpler than SQLite because it avoids the idea of relational data and SQL.
You could use virus signatures as keys and their names as values, for example.
SQLite 可能是您的应用程序的不错选择。与 SQL Server / Oracle 等成熟的 RDBMS 系统相比，它是一个占用空间较小的 SQL 引擎。
旁注：您可能会考虑将此数据库保留在相关系统之外的位置。您似乎担心恶意用户会修改您驱动器的内容。如果是这样，这些相同的用户可以很容易地知道您的方案，并确保他们更改的任何文件也反映在您的数据库中的新哈希值中，因此当您进行比较时，它们将始终匹配。相反，如果您运行程序，将哈希值存储在位于不同系统上的数据库中，那么您可以更放心地认为您的数据库没有受到损害，因为两个系统都必须被接管。
SQLite might be a good choice for your application. It's a light footprint SQL engine as compared to full blown RDBMS systems like SQL Server / Oracle, etc.
A side note: you might consider keeping this database in a location other than the system in question. It seems as if you are concerned about malicious users modifying the contents of your drive. If so, those same users could easily be aware of your scheme and ensure that any files they change are also reflected with a new hash value in your database, so when you go to do a comparison, they will always match. If instead, you run your program, store the hash values in a database that is on a different system, you can be more comfortable that your database wasn't compromised, because both systems would have to have been taken over.
专业的杀毒软件不会使用sql来匹配病毒特征码。它是一个更加复杂的过程。
如果您对以下内容感兴趣，请查看 http://sourceforge.net/projects/clamwin/主题。或者关于卡巴斯基 2008 泄露的消息来源......
professional avs don't use sql to match virus signatures. it;s a much more complicated process.
take a look at http://sourceforge.net/projects/clamwin/ if you are interested in the subject. Or on Kaspersky 2008 leaked sources ...