VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-11 22:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add dotnet tests. (#1109)

Browse Source 
Add some tests for the dotnet module, which uses the smallest .NET binary I had
laying around that exercises a fair bit of the code. In particular it has a
resource, guids, assembly information and a couple of other things that make for
good tests.
This commit is contained in:
Wesley Shields
2019-08-12 09:07:58 +02:00
committed by Victor M. Alvarez
parent 5aa70a050e
commit 2bafaf4ec3
3 changed files with 73 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile.am
+6
View File
@@ -86,6 +86,12 @@ test_dex_SOURCES = tests/test-dex.c tests/util.c
test_dex_LDADD = libyara/.libs/libyara.a
endif
if DOTNET_MODULE
check_PROGRAMS+=test-dotnet
test_dotnet_SOURCES = tests/test-dotnet.c tests/util.c
test_dotnet_LDADD = libyara/.libs/libyara.a
endif
# man pages
man1_MANS = yara.man yarac.man
tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171
BIN
View File
Binary file not shown.
tests/test-dotnet.c
+67
View File
@@ -0,0 +1,67 @@
#include <yara.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include "util.h"
int main(int argc, char** argv)
{
char *top_srcdir = getenv("TOP_SRCDIR");
if (top_srcdir)
chdir(top_srcdir);
yr_initialize();
assert_true_rule_file(
"import \"dotnet\" \
rule test { \
condition: \
dotnet.assembly.name == \"hpjsoaputility.Sv.resources\" \
}",
"tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
assert_true_rule_file(
"import \"dotnet\" \
rule test { \
condition: \
dotnet.number_of_resources == 1 and \
dotnet.resources[0].offset == 724 and \
dotnet.resources[0].length == 180 and \
dotnet.resources[0].name == \"hpjsoaputility.XmlStreamSoapExtension.pt.resources\" \
}",
"tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
assert_true_rule_file(
"import \"dotnet\" \
rule test { \
condition: \
dotnet.number_of_guids == 1 and \
dotnet.guids[0] == \"3764d539-e21a-4366-bc7c-b56fa67efbb0\" \
}",
"tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
assert_true_rule_file(
"import \"dotnet\" \
rule test { \
condition: \
dotnet.number_of_streams == 5 and \
dotnet.streams[0].name == \"#~\" and \
dotnet.streams[1].name == \"#Strings\" and \
dotnet.streams[2].name == \"#US\" and \
dotnet.streams[3].name == \"#GUID\" and \
dotnet.streams[4].name == \"#Blob\" \
}",
"tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
assert_true_rule_file(
"import \"dotnet\" \
rule test { \
condition: \
dotnet.module_name == \"hpjsoaputility.Sv.resources.dll\" and \
dotnet.version == \"v2.0.50727\" \
}",
"tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
yr_finalize();
return 0;
}