VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-11 22:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add test case for uppercase atoms.

Browse Source 
Related to #1716.
This commit is contained in:
Victor M. Alvarez
2022-05-28 19:30:10 +02:00
parent 1fe26dcf78
commit 25f576adf3
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test-atoms.c
+9
View File
@@ -167,6 +167,12 @@ void test_heuristic_quality()
.bytes = {0x61, 0x62, 0x63, 0x64},
.mask = {0xFF, 0xFF, 0xFF, 0xFF}};
// ABCD
YR_ATOM a41424344 = {
.length = 4,
.bytes = {0x41, 0x42, 0x43, 0x44},
.mask = {0xFF, 0xFF, 0xFF, 0xFF}};
// abc.
YR_ATOM a6162632E = {
.length = 4,
@@ -195,6 +201,8 @@ void test_heuristic_quality()
int qCCCCCCCC = yr_atoms_heuristic_quality(&c, &aCCCCCCCC);
int qFFFFFFFF = yr_atoms_heuristic_quality(&c, &aFFFFFFFF);
int q61626364 = yr_atoms_heuristic_quality(&c, &a61626364);
int q41424344 = yr_atoms_heuristic_quality(&c, &a41424344);
int q6162632E = yr_atoms_heuristic_quality(&c, &a6162632E);
a010203.mask[1] = 0x00;
@@ -239,6 +247,7 @@ void test_heuristic_quality()
assert_true_expr(q01020102 > q010203);
assert_true_expr(q01020304 > q61626364);
assert_true_expr(q010203 < q61626364);
assert_true_expr(q41424344 == q61626364);
assert_true_expr(q6162632E > q61626364);
// Byte sequences like 90 90 90 90 and CC CC CC CC are using as function