SignFinder v2.0 - Domain-Driven Design Architecture

PE32 signature finder | Anti-virus signature removal | Malware analysis tool | ClamAV signature detection | Domain-Driven Design | Clean Architecture

Overview

SignFinder is a powerful tool for PE32 file analysis and anti-virus signature localization. It helps security researchers and malware analysts identify where anti-virus signatures are located in PE executables by systematically zeroing out different parts of the file or by directly searching for ClamAV signature patterns.

The tool has been completely refactored following Domain-Driven Design (DDD) and Clean Architecture principles.

Features

• 🔍 Fast Mode: Quickly identify signature location (emulator, import directory, sections)
• 📋 Header Mode: Test PE headers by zeroing each field individually
• 📦 Section Mode: Divide sections into parts for granular analysis
• 🎯 Manual Mode: Test specific byte ranges with custom part counts
• 🔄 Sliding Window Mode: Advanced analysis with byte-by-byte sliding window
• 🦠 ClamAV Signature Mode: Search for specific ClamAV signatures in PE files
• ✅ Duplicate Detection: Automatically prevents creating identical files
• 📊 RVA Information: Includes Relative Virtual Address for each section
• 🧹 Zero Mode: Remove detected signatures from files

Installation

pip install -r requirements.txt

Usage Modes

1. Info Mode

Display detailed PE file section information:

python main.py path_to_exe info

Output: Section names, offsets, sizes, RVAs, and characteristics.

---

2. Fast Mode

Quickly identify signature type (emulator, import, sections):

python main.py path_to_exe fast

How it works:

1. Tests DOS stub (emulator signatures)
2. Tests import directory
3. Tests each section individually
4. Reports which component triggers AV detection

Use case: First step in signature analysis to narrow down search area.

---

3. Header Mode

Test PE headers by zeroing each field:

python main.py path_to_exe head

How it works:

• Systematically zeros out each PE header field
• Creates test files for each field
• Identifies which header fields contain AV signatures

Use case: Detect signatures in PE headers (rare but possible).

---

4. Section Mode

Test a specific section by dividing it into parts:

python main.py path_to_exe sect section_number [-p part_count]

Parameters:

• section_number: Section index (0-based)
• -p part_count: Number of parts to divide section into (default: 10)

How it works:

1. Divides the specified section into N equal parts
2. Creates test files with each part zeroed out
3. Identifies which part contains the signature

Use case: Narrow down signature location within a specific section.

---

5. Manual Mode

Test a specific byte range:

python main.py path_to_exe man offset size part_number

Parameters:

• offset: Starting byte offset
• size: Number of bytes to analyze
• part_number: How many parts to divide the range into

How it works:

• Divides the specified byte range into parts
• Creates test files with each part zeroed
• Pinpoints exact signature location

Use case: Final precision targeting after narrowing down with other modes.

---

6. Manual2 Mode (Sliding Window)

Advanced byte-by-byte sliding window testing:

python main.py path_to_exe man2 offset size window_size

Parameters:

• offset: Starting byte offset
• size: Total range size
• window_size: Size of sliding window in bytes

How it works:

• Slides a window of specified size byte-by-byte through the range
• Creates test files with each window position zeroed
• Provides byte-level precision

Use case: Ultra-precise signature localization when exact byte position is needed.

---

7. ClamAV Signature Mode 🦠

Search for specific ClamAV signatures in PE files:

python main.py path_to_exe sig clamav_db_path [-n signature_name] [-z]

Parameters:

• clamav_db_path: Path to ClamAV LDB database file (e.g., clamav/daily.ldb)
• -n signature_name: Optional signature name to search for (partial match)
• -z: Optional flag to zero out found signatures and save cleaned file

How it works:

ClamAV Signature Format

ClamAV LDB signatures follow this format:

SignatureName;Engine:version,Target:type;conditions;pattern1;pattern2;...

Example:

Win.Spyware.Zbot-9841872-0;Engine:81-255,Target:1;0&1&2&3&4;496e74...;4d6f7a...;677261...;536372...;556e6b...

Components:

• SignatureName: Malware family identifier
• Engine:81-255: ClamAV engine version range
• Target:1: Target type (1 = PE files)
• Conditions: 0&1&2&3&4 means patterns 0, 1, 2, 3, and 4 must ALL be found
• Patterns: Hex-encoded byte patterns to search for

Pattern Types

1. Plain hex: 496e7465726e616c → searches for exact bytes
2. Wide strings (::w): 677261625f...::w → ASCII hex converted to UTF-16LE
3. Wildcards: ?? → matches any byte (treated as 00 in current implementation)

Search Algorithm

1. Parse signature: Extract name, target type, conditions, and patterns
2. Decode patterns: Convert hex strings to bytes, handle wide strings
3. Search entire file: Find all occurrences of each pattern
4. Check conditions: Verify all required patterns are present
5. Report results: Show offset, section, RVA, hex dump, and disassembly

Example Usage

Search for specific Zbot signature:

python main.py tests/samples_pass_infected/zeus sig clamav/daily.ldb -n "Win.Spyware.Zbot-9841872-0"

Output:

DEBUG: Partial match 'Win.Spyware.Zbot-9841872-0'
DEBUG: Found 'Win.Spyware.Zbot-9841872-0', 5 patterns: [34, 55, 50, 24, 27]
[-] Found 5 signature location(s):

Signature Name                           Pattern  Offset     Section         RVA       
Win.Spyware.Zbot-9841872-0               1        0x00001D50  [0].text        0x00002950
  Pattern (34 bytes): 496e7465726e616c20636f6d6d616e64206572726f72...
  As string: "Internal command error at line %u."
  
Win.Spyware.Zbot-9841872-0               2        0x0000379C  [0].text        0x0000439C
  Pattern (55 bytes): 4d6f7a696c6c612f342e302028636f6d70617469626c65...
  As string: "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
...

Search and remove signatures (zero mode):

python main.py tests/samples_pass_infected/zeus sig clamav/daily.ldb -n "Zbot" -z

Output:

[+] Zeroing signatures...
  Zeroed 0x0000379C-0x000037D3 (55 bytes)
  Zeroed 0x00003664-0x00003696 (50 bytes)
  Zeroed 0x00001D50-0x00001D72 (34 bytes)
  Zeroed 0x00001D34-0x00001D4C (24 bytes)
  Zeroed 0x00001CFC-0x00001D17 (27 bytes)
[+] Saved: tests/samples_pass_infected/zeus_zeros_clean

Condition Logic

Conditions specify which patterns must be found:

• 0&1&2&3&4: All patterns 0, 1, 2, 3, 4 must be present
• 0&1: Only patterns 0 and 1 must be present
• 0-4: Range notation, patterns 0 through 4 must be present
• No conditions: Any pattern match is reported

Important: Conditions indicate which patterns are required, NOT which PE sections to search. All patterns are searched across the entire file.

---

Workflow Example

Traditional Signature Hunting (Manual Approach)

# Step 1: Get file info
python main.py malware.exe info

# Step 2: Quick scan to identify area
python main.py malware.exe fast

# Step 3: If signature is in section 0, divide it into parts
python main.py malware.exe sect 0 -p 20

# Step 4: Narrow down to specific byte range
python main.py malware.exe man 0x1000 0x500 10

# Step 5: Precise location with sliding window
python main.py malware.exe man2 0x1200 0x100 32

ClamAV Signature Detection (Direct Approach)

# Search for all Zbot signatures
python main.py malware.exe sig clamav/daily.ldb -n "Zbot"

# Search for specific signature and remove it
python main.py malware.exe sig clamav/daily.ldb -n "Win.Spyware.Zbot-9841872-0" -z

Architecture

The codebase is organized into four main layers:

1. Domain Layer (signfinder/domain/): Core business logic, entities, value objects, and domain services
2. Application Layer (signfinder/application/): Use cases that orchestrate domain objects
3. Infrastructure Layer (signfinder/infrastructure/): Adapters for external concerns (file I/O, PE parsing, ClamAV parsing)
4. Presentation Layer (signfinder/presentation/): CLI interface

See ARCHITECTURE.md for detailed documentation.

Project Structure

signfinder/
├── domain/              # Business logic (entities, value objects, services)
├── application/         # Use cases
│   └── use_cases/
│       ├── fast_mode_use_case.py
│       ├── header_mode_use_case.py
│       ├── section_mode_use_case.py
│       ├── manual_mode_use_case.py
│       ├── signature_mode_use_case.py  # ClamAV signature search
│       └── info_use_case.py
├── infrastructure/      # Adapters (file I/O, PE parsing)
│   └── adapters/
│       ├── clamav_parser.py  # ClamAV LDB parser
│       ├── pe_parser.py
│       ├── file_io.py
│       └── disassembler.py
├── presentation/        # CLI interface
└── di/                  # Dependency injection

main.py                  # Entry point
requirements.txt         # Dependencies

Development

Adding a New Mode

1. Create a new use case in signfinder/application/use_cases/
2. Add CLI handler in signfinder/presentation/cli.py
3. Register in signfinder/di/__init__.py

Use Cases

• Malware Analysis: Identify AV signature locations in PE files
• Security Research: Understand how anti-virus engines detect malware
• ClamAV Signature Testing: Verify ClamAV signatures against samples
• Reverse Engineering: Analyze PE file structure and modifications
• Educational: Learn about PE32 format and signature detection techniques

Technologies

• Python 3.8+: Core language
• pefile: PE32 file parsing library
• capstone: Disassembly engine for x86/x64
• Domain-Driven Design: Business logic organization
• Clean Architecture: Layer separation and dependency inversion

Keywords

PE32 PE file malware analysis anti-virus signature detection ClamAV reverse engineering security research file modification Domain-Driven Design Clean Architecture Python pefile binary analysis executable analysis signature localization AV bypass malware research LDB signaturesSignatureName;Engine:version

License

Same as original project.

---

Tags: pe32 malware-analysis security-research reverse-engineering anti-virus clamav signature-detection domain-driven-design clean-architecture python pefile binary-analysis file-modification