virus scan application

Subject: virus scan application

From: "Vishal Shetye" <email@hidden>

Date: Fri, 3 Aug 2007 22:37:48 +0530

Delivered-to: email@hidden

Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:from:to:subject:date:message-id:mime-version:content-type:x-mailer:x-mimeole:thread-index; b=UlShwz1QeRdasF/dIs4wdcj+9sVAQZ0I5FBgo0D98YSPPQ+70r1rIHCxJABPtkfKGm6QRlXc0o/BrEWjIcM9pOIbWCg0j+8DFBSUerNChQ2HrKgsf5sq5dtPuIR8y6Y8o2MjHEziLCzhNGKcrKhJqMvD/cwvqs7UXNLw/I0/qaE=

Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:from:to:subject:date:message-id:mime-version:content-type:x-mailer:x-mimeole:thread-index; b=lSSsJwbCxxGq0UErtdcSTUGssk+h5rMvtvHkZGKIQo5eZ2RuGcS+xXY+WxjXvmsDjPDSXjqcfaGIKftTIZNVJdjPIKMHw1o1tpeGaJ81KEKsEwtg3Q0BkPiCnclqaXQ4zdqZpyTYUWLQkWyafja7zJBKlInpmlkSMz4G9xEpRvA=

Thread-index: AcfV8NEBB8aGNnalSWG4I2xZ6tCfGg==

after going through several links like kauth (http://developer.apple.com/technotes/tn2005/tn2127.html),

KauthORama source, mac osx internals by amit singh, http://developer.apple.com/documentation/Darwin/Conceptual/KernelProgramming and many mailing list discussions I find myself really confused.

My simple question is, with currently supported kpis is virus-scan application really feasible?

It requires hooking of system calls, use kauth vnode scope, so far so good. But opening file for virus scan (low level open), denying access, such functions deal with file system structures.

Links like http://developer.apple.com/documentation/Darwin/Reference/KPI_Reference/vnode/index.html are not much developer friendly as most of the functions have “Discussion” as “Description forthcoming”, link was last updated on 2006-06-20.

If such an application is really feasible, could anybody please provide some hints for where to look for?

- vishal shetye

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (email@hidden) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/email@hidden This email sent to email@hidden

Follow-Ups:

Re: virus scan application
- From: Michael Smith <email@hidden>
Re: virus scan application
- From: Terry Lambert <email@hidden>