---
name: "libsigscan"
section: "3"
platform: "linux"
package: "libsigscan-dev"
version: "20240505-1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/libsigscan"
---

# libsigscan(3)

Library for binary signature scanning

## NAME

**libsigscan.h** – Library for binary signature scanning

## SYNOPSIS

**#include \<libsigscan.h\>**

Support functions

*const* *char* *\**\

**libsigscan\_get\_version**(*void*);

*int*\

**libsigscan\_get\_access\_flags\_read**(*void*);

*int*\

**libsigscan\_get\_codepage**(*int \*codepage*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_set\_codepage**(*int codepage*, *libsigscan\_error\_t \*\*error*);

Notify functions

*void*\

**libsigscan\_notify\_set\_verbose**(*int verbose*);

*int*\

**libsigscan\_notify\_set\_stream**(*FILE \*stream*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_notify\_stream\_open**(*const char \*filename*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_notify\_stream\_close**(*libsigscan\_error\_t \*\*error*);

Error functions

*void*\

**libsigscan\_error\_free**(*libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_error\_fprint**(*libsigscan\_error\_t \*error*, *FILE \*stream*);

*int*\

**libsigscan\_error\_sprint**(*libsigscan\_error\_t \*error*, *char \*string*, *size\_t size*);

*int*\

**libsigscan\_error\_backtrace\_fprint**(*libsigscan\_error\_t \*error*, *FILE \*stream*);

*int*\

**libsigscan\_error\_backtrace\_sprint**(*libsigscan\_error\_t \*error*, *char \*string*, *size\_t size*);

Scanner functions

*int*\

**libsigscan\_scanner\_initialize**(*libsigscan\_scanner\_t \*\*scanner*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scanner\_free**(*libsigscan\_scanner\_t \*\*scanner*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scanner\_signal\_abort**(*libsigscan\_scanner\_t \*scanner*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scanner\_set\_scan\_buffer\_size**(*libsigscan\_scanner\_t \*scanner*, *size\_t scan\_buffer\_size*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scanner\_add\_signature**(*libsigscan\_scanner\_t \*scanner*, *const char \*identifier*, *size\_t identifier\_length*, *off64\_t pattern\_offset*, *const uint8\_t \*pattern*, *size\_t pattern\_size*, *uint32\_t signature\_flags*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scanner\_scan\_start**(*libsigscan\_scanner\_t \*scanner*, *libsigscan\_scan\_state\_t \*scan\_state*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scanner\_scan\_stop**(*libsigscan\_scanner\_t \*scanner*, *libsigscan\_scan\_state\_t \*scan\_state*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scanner\_scan\_buffer**(*libsigscan\_scanner\_t \*scanner*, *libsigscan\_scan\_state\_t \*scan\_state*, *const uint8\_t \*buffer*, *size\_t buffer\_size*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scanner\_scan\_file**(*libsigscan\_scanner\_t \*scanner*, *libsigscan\_scan\_state\_t \*scan\_state*, *const char \*filename*, *libsigscan\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libsigscan\_scanner\_scan\_file\_wide**(*libsigscan\_scanner\_t \*scanner*, *libsigscan\_scan\_state\_t \*scan\_state*, *const wchar\_t \*filename*, *libsigscan\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libsigscan\_scanner\_scan\_file\_io\_handle**(*libsigscan\_scanner\_t \*scanner*, *libsigscan\_scan\_state\_t \*scan\_state*, *libbfio\_handle\_t \*file\_io\_handle*, *libsigscan\_error\_t \*\*error*);

Scan state functions

*int*\

**libsigscan\_scan\_state\_initialize**(*libsigscan\_scan\_state\_t \*\*scan\_state*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scan\_state\_free**(*libsigscan\_scan\_state\_t \*\*scan\_state*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scan\_state\_set\_data\_size**(*libsigscan\_scan\_state\_t \*scan\_state*, *size64\_t data\_size*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scan\_state\_get\_number\_of\_results**(*libsigscan\_scan\_state\_t \*scan\_state*, *int \*number\_of\_results*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scan\_state\_get\_result**(*libsigscan\_scan\_state\_t \*scan\_state*, *int result\_index*, *libsigscan\_scan\_result\_t \*\*scan\_result*, *libsigscan\_error\_t \*\*error*);

Scan result functions

*int*\

**libsigscan\_scan\_result\_free**(*libsigscan\_scan\_result\_t \*\*scan\_result*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scan\_result\_get\_identifier\_size**(*libsigscan\_scan\_result\_t \*scan\_result*, *size\_t \*identifier\_size*, *libsigscan\_error\_t \*\*error*);

*int*\

**libsigscan\_scan\_result\_get\_identifier**(*libsigscan\_scan\_result\_t \*scan\_result*, *char \*identifier*, *size\_t identifier\_size*, *libsigscan\_error\_t \*\*error*);

## DESCRIPTION

The **libsigscan\_get\_version**() function is used to retrieve the library version.

## RETURN VALUES

Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values see "libsigscan.h".

## ENVIRONMENT

None

## FILES

libsigscan allows to be compiled with wide character support (wchar\_t).

To compile libsigscan with wide character support use: *./configure* *--enable-wide-character-type=yes*\
  or define: *\_UNICODE*\
  or *UNICODE*\
  during compilation.

*LIBSIGSCAN\_WIDE\_CHARACTER\_TYPE*\
  in libsigscan/features.h can be used to determine if libsigscan was compiled with wide character support.

## BUGS

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libsigscan/issues

## AUTHOR

These man pages are generated from "libsigscan.h".

## COPYRIGHT

Copyright (C) 2014-2024, Joachim Metz \<joachim.metz@gmail.com\>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO

the libsigscan.h include file