# Xvirus SDK 4.0.4

Xvirus SDK 4.0.4 C++ bindings x64.

## Table of Contents

- [Xvirus SDK 4.0.4](#xvirus-sdk-40)
  - [Table of Contents](#table-of-contents)
  - [Minimum Requirements](#minimum-requirements)
  - [Changelog](#changelog)
  - [Known Issues](#known-issues)
  - [Get Started](#get-started)
  - [Avaiable Functions](#avaiable-functions)
  - [Settings](#settings)

## Minimum Requirements

To run Xvirus SDK you need:

- .NET 5 Runtime - [download](<[https://link](https://dotnet.microsoft.com/download/dotnet/thank-you/runtime-5.0.11-windows-x64-installer)>)
- Visual C++ Redistributable 2019 - [download](https://aka.ms/vs/16/release/vc_redist.x64.exe)

## Changelog

- Completely redone in .NET 5
- Now supports Linux (CLI and C# bindings only)
- Added XvirusAI scan engine (BETA)
- Scan speed is up to 2x faster
- Fixed memory usage spike when scanning large files
- Removed file size limit for scanned files by default
- The checkUpdate function can now check for SDK updates
- Added 3 new settings "EnableAIScan", "MaxScanLength" and "DatabaseVersion"

## Known Issues

- XvirusAI engine is still in BETA. It is not recomended to use in production yet.
- The checkUpdate function can now check for SDK updates but can't update it

## Get Started

The "`example`" folder contains an example project on how to import and use Xvirus SDK in C++.

This project shows you how to statically load Xvirus SDK using `xvneng.lib`, you can also dinamically load `xvneng.dll` like any other dll, [see](https://stackoverflow.com/questions/8696653/dynamically-load-a-function-from-a-dll).

You can run it by building it, copying the files from the `bin` folder to the output folder of the build and then running `xvbdc.exe`.

## Avaiable Functions

You can find the declaration of all functions and structs in the file `xvneng.h` located in the "headers" folder.

- **load** - Loads Xvirus Scan Engine into memory, if set `force`=true it will reload the scan engine, even if it is already loaded.
- **unload** - Unloads Xvirus Scan Engine from memory.
- **scan** - Scans the file located at `filepath`. It will return a [`ScanResult`](#Model).
- **scanAsString** - Scans the file located at `filepath`. It will return one of the following strings:
  - "**Safe**" - If no malware is detected.
  - "**Malware**" - If malware is detected but the name isn't known.
  - **_Malware Name_** - If it is malware from a known family (example: "Trojan.Downloader").
  - "**AI.{aiScore}**" - Score of the file using XvirusAI from 0 to 100, the higher the score the more probable it is malicious (example: "AI.99").
  - "**File not found!**" - If no file is found in the submited path.
  - "**File too big!**" - If the file size is bigger than the set limit.
  - "**Could not get file hash!**" - There was an error calculating the hash of the file.
- **checkUpdates** - Checks and updates the databases and AI engine to the most recent versions. If `checkSDKUpdates`=true then it will also check for SDK updates. If `loadDBAfterUpdate`=true then it will reload the Xvirus Scan Engine after the update is done. It can return the following strings:
  - "**There is a new SDK version available!**"
  - "**Database was updated!**"
  - "**Database is up-to-date!**"
- **getSettings** - returns a string representation of the `settings.json` file.
- **version** - returns the version of the SDK/CLI.

![functions](./functions.JPG)

## Model

The `scan` function returns a struct `ScanResult` with the following properties:

```c++
struct ScanResult {
	bool isMalware; // true if malware
	double score; // between 0 and 1, higher score means more likely to be malware, -1 if there was an error
	char* name; // detection name
};
```

## Settings

Settings are located in the "`settings.json`" file in the root folder of the SDK. There are 4 avaiable options:

- **EnableHeuristics** - Enables heuristics scanning of files. Default: _true_
- **EnableAIScan** - Enables XvirusAI scan engine. This feature is still in BETA. Default: _false_
- **MaxScanLength** - Maximum file size to be scanned in bytes. If set "null" then there is no limit. Default: _null_
- **DatabaseVersion** - KeyValue list of database files version. This is updated automatically when using the "checkUpdate()" function.

Example of a `settings.json` file:

```JSON
{
  "EnableHeuristics": true,
  "EnableAIScan": false,
  "MaxScanLength": null,
  "DatabaseVersion": {
    "AIModel": 0,
    "MainDB": 0,
    "DailyDB": 0,
    "WhiteDB": 0,
    "DailywlDB": 0,
    "HeurDB": 0,
    "HeurDB2": 0,
    "MalvendorDB": 0
  }
}
```

## Exceptions

If any of the functions fail it may return an [exception](https://www.cplusplus.com/doc/tutorial/exceptions/).

All exceptions are logged in the `errorlog.txt` file.