The ClamAV® Bytecode Compiler is a tool to build cross-platform advanced malware detection plugins for the ClamAV® open source antivirus engine. We call these plugins "bytecode signatures". Bytecode signatures are are executed by a ClamAV using either an LLVM JIT runtime or an interpeter runtime. These signatures extend ClamAV's file format support and provide detection capabilities above and beyond the limitations of content-based logical signatures.
At present the pdf documentation is dated. Specifically, the instructions for building the compiler or no longer correct. The documentation will be updated as time permits.
The PDF documentation still provides valuable instructions for writing and compiling signatures, and documents features of the bytecode signature API.
git clone git://github.com/Cisco-Talos/clamav-bytecode-compiler
LLVM and Clang, version 8 or newer
Python 3.6 or newer.
mkdir build && cd build cmake .. \ -D CMAKE_BUILD_TYPE=Release \ -D CMAKE_INSTALL_PREFIX=<install path>
cmake --build .
cmake --build . --target install
Build with a specific LLVM version and specific ClamAV install that installs to local directory:
cmake .. \ -D CMAKE_INSTALL_PREFIX=install \ -D ENABLE_TESTS=ON \ -D LLVM_ROOT=/usr/lib/llvm-8 \ -D ClamAV_HOME=$HOME/clams/0.105.0 make -j12 ctest -V make install
For information about the features in this and prior releases, read the news.
The best way to get in touch with the ClamAV community is to join our mailing lists and to join us on Discord.
The ClamAV development team welcomes code contributions. Thanks for joining us!
ClamAV is licensed for public/open source use under the GNU General Public License, Version 2 (GPLv2).
COPYING/COPYING.txt for a copy of the license.
ClamAV contains a number of components that include code copied in part or in whole from 3rd party projects and whose code is not owned by Cisco and which are licensed differently than ClamAV. These include:
= 9.0.0: Apache License 2.0 with LLVM Exceptions
COPYING directory for a copy of the 3rd party project licenses.