diff --git a/tests/test-atoms.c b/tests/test-atoms.c index 217d5817..59572a3f 100644 --- a/tests/test-atoms.c +++ b/tests/test-atoms.c @@ -167,6 +167,12 @@ void test_heuristic_quality() .bytes = {0x61, 0x62, 0x63, 0x64}, .mask = {0xFF, 0xFF, 0xFF, 0xFF}}; + // ABCD + YR_ATOM a41424344 = { + .length = 4, + .bytes = {0x41, 0x42, 0x43, 0x44}, + .mask = {0xFF, 0xFF, 0xFF, 0xFF}}; + // abc. YR_ATOM a6162632E = { .length = 4, @@ -195,6 +201,8 @@ void test_heuristic_quality() int qCCCCCCCC = yr_atoms_heuristic_quality(&c, &aCCCCCCCC); int qFFFFFFFF = yr_atoms_heuristic_quality(&c, &aFFFFFFFF); int q61626364 = yr_atoms_heuristic_quality(&c, &a61626364); + int q41424344 = yr_atoms_heuristic_quality(&c, &a41424344); + int q6162632E = yr_atoms_heuristic_quality(&c, &a6162632E); a010203.mask[1] = 0x00; @@ -239,6 +247,7 @@ void test_heuristic_quality() assert_true_expr(q01020102 > q010203); assert_true_expr(q01020304 > q61626364); assert_true_expr(q010203 < q61626364); + assert_true_expr(q41424344 == q61626364); assert_true_expr(q6162632E > q61626364); // Byte sequences like 90 90 90 90 and CC CC CC CC are using as function