From 2bafaf4ec354e57ffdbde8725fbcb6746bb94c63 Mon Sep 17 00:00:00 2001
From: Wesley Shields <wxs@atarininja.org>
Date: Mon, 12 Aug 2019 03:07:58 -0400
Subject: [PATCH] Add dotnet tests. (#1109)

Add some tests for the dotnet module, which uses the smallest .NET binary I had
laying around that exercises a fair bit of the code. In particular it has a
resource, guids, assembly information and a couple of other things that make for
good tests.
---
 Makefile.am                                   |   6 ++
 ...4f7a4147347a7a97271370583586c9e587fd396171 | Bin 0 -> 3584 bytes
 tests/test-dotnet.c                           |  67 ++++++++++++++++++
 3 files changed, 73 insertions(+)
 create mode 100644 tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171
 create mode 100644 tests/test-dotnet.c

diff --git a/Makefile.am b/Makefile.am
index 0240331e..8fce57cd 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -86,6 +86,12 @@ test_dex_SOURCES = tests/test-dex.c tests/util.c
 test_dex_LDADD = libyara/.libs/libyara.a
 endif
 
+if DOTNET_MODULE
+check_PROGRAMS+=test-dotnet
+test_dotnet_SOURCES = tests/test-dotnet.c tests/util.c
+test_dotnet_LDADD = libyara/.libs/libyara.a
+endif
+
 # man pages
 man1_MANS = yara.man yarac.man
 
diff --git a/tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171 b/tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171
new file mode 100644
index 0000000000000000000000000000000000000000..edb040c76b860fae2ddf3a0e5cfe4c84d8afce1b
GIT binary patch
literal 3584
zcmeHJdu$X%82`2}+9DMqB99ujv_+)la(&Z;>Rnr)Kxu2QZHn^f-rdqJ?A=~=_n=oE
zUL++J4WWUki48&&5Cwy=Mj${y5E3E}V-z%Eh!_=Zr~+aHwf<(V*B&iFP5ejVw>RH>
zuldb4-^|Y5+$T3sG!ez1_4E+!MbF5_`Q2F%?xgYilc+P{RLWkV{8UO!lVXTIU2D`O
zkLZ%TUd<GpvZ(vLqT&@xD;=UobIX=t!xGbap{u47l?&0d>aB+=!?RtasFa~XJW(7h
ztbrD$gNbN1G{!`9QK7sc@%&j&K{VJaR}j`^Yb6@afBk*0%3?wBz;!Ue21r(jfz&{B
z-$2{n(M4cK#Kl7|i_k5m+-yR3$AZDf*NMC%NhE5p=!Wisk>_TEz&0up7%I#*i!Q4g
z0(q_tFfyzGi6gEU*4xO&>I!1HMNuq0n}QOe4hh^!bXE+Vi7NELUfbQerw?9U{-R~;
z#qU2`A2-f=BYE3t-8c66xSdy9%?I^~Unl3B*|ybOQoF9YCjXmrWn@o$`23D@ZEGr8
z7MxzYud5~Bb6u`!uK2avRdz;tY4+PuIWPNW&at*M{&GN_=l-&7g1m9U<){3Ut~LKy
zvbXFfm#uca@^f}q>#fOK*G~CeYK!Vba;Hyr9}>{Fqp6O7Vags$wQOj9-6b1+Qnf6(
zWj#~$7%oj$6=$YcC+miyd5f|wR`z6yC4SZP>vEA-_M5t-W{OpQr>eN-$blMdsq8Is
z78FQ%uDtxL!kk>$I<+u$@MM0ksd(h@><-zC+~X>HDf_XUiygCz1!7r;wrv?pBF|co
zUBE1{q=H{ZOI?jafv{<4sSZ<Dyp0Bn=m0J|7OAxkdJQs8J*Cd9omGmy6Z(ftFIF`t
zdPXn_Lq=ks*_1bh92x}!ME1Ic`>@P()`(8@_HmR>4<NRf^F^FDbKcJRE^tPnQEXia
zG>yj72+qfFp2GQ~oM&-vp`mn~EEvo9IL=c!&)_@<JSG@IwT@WV&d}57TZ$I2nm!UJ
z5i)DND+whrZLa3_tMX$M-f!yLti`JAGO_VwHw@Y1R0B1NsmgW})phz!nJg|-)BBvI
zvf<Jd9~;mg5*}Hid3=&LFxXM0V|tf4*ioYS0=m-JbO%?BjuYyU^riiyntV$PP4f9o
zMODmz#jy<UefVIzRh91IC!aacUGGtGgk;I%0Os^&Q}(j+Z}FM^sJx8PBJT=6aTkpJ
zYH`VdmG5fXSKr!0@$a?FuN#wlv2A4cetq)`1zFiEj}G~`$9{hKmd!`&V?;qn3U0v`
zQB06%6ENb~MnSK3*t6J8#!ki*&!#;c&L7@*=GE;T6SsYL`SWWXXK!6Pylc{>F6nAf
z#_5a&7iLskIrnM8nD;xQZYEEjlQ!{ceoElVZ^oLBw0$d1md`km@MfZ?@SPi@f}KNK
zrR4U!mZlvG8+NanxBF1bBZrUAe<Ho%!V!Jp&W&02=U(X=KBPYBiz8!WHdMA}d=MP{
zdaOYB?pb^9LF7jjOct3mn8NpEzh_a2rkASfTuJeU&Xz1&*j6y=Nhi_9rT+#K_`NZD
z&{ZG0nXGrPvvsj=N4<^cSj201EGie)I(%CfflsGuNVBMtDxl8-p8=WC!I<tpLhq?S
z>)Nd&n9Taexi|E=i-6@;cBctIl}HDUg1b=$rk56z#{FsRXi*Kk608RN5}An8poM5p
zOd3E1<YXdBfxYogNIb?$;U|}zkcl#JdkTH=rI_6y7sv74Hjju{8{HofTZdR3(fzq(
z;ij{q<>F!USSW`ID4X(VDo?cm2T|awGx=CA)}o?*5_zB#HIa{&08xX*M}9uP3Vf3S
zz;e(saGhtU!K))rmaT={Kw)Qe5?@O>tc@JG1V}!NWmRbex``N(&%^Sl?6tFsu{^@n
zXWGA$Pbsfg73R^9qaXR2*y-D=_E$A4;}~|V)4)g%c1^{K#D9!~W#9WGhW>9f<lXyA
K{eOjnEAS^dautsN

literal 0
HcmV?d00001

diff --git a/tests/test-dotnet.c b/tests/test-dotnet.c
new file mode 100644
index 00000000..e70dff41
--- /dev/null
+++ b/tests/test-dotnet.c
@@ -0,0 +1,67 @@
+#include <yara.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include "util.h"
+
+int main(int argc, char** argv)
+{
+  char *top_srcdir = getenv("TOP_SRCDIR");
+  if (top_srcdir)
+    chdir(top_srcdir);
+
+  yr_initialize();
+
+  assert_true_rule_file(
+      "import \"dotnet\" \
+      rule test { \
+        condition: \
+          dotnet.assembly.name == \"hpjsoaputility.Sv.resources\" \
+      }",
+      "tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
+
+  assert_true_rule_file(
+      "import \"dotnet\" \
+      rule test { \
+        condition: \
+          dotnet.number_of_resources == 1 and \
+          dotnet.resources[0].offset == 724 and \
+          dotnet.resources[0].length == 180 and \
+          dotnet.resources[0].name == \"hpjsoaputility.XmlStreamSoapExtension.pt.resources\" \
+      }",
+      "tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
+
+  assert_true_rule_file(
+      "import \"dotnet\" \
+      rule test { \
+        condition: \
+          dotnet.number_of_guids == 1 and \
+          dotnet.guids[0] == \"3764d539-e21a-4366-bc7c-b56fa67efbb0\" \
+      }",
+      "tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
+
+  assert_true_rule_file(
+      "import \"dotnet\" \
+      rule test { \
+        condition: \
+          dotnet.number_of_streams == 5 and \
+          dotnet.streams[0].name == \"#~\" and \
+          dotnet.streams[1].name == \"#Strings\" and \
+          dotnet.streams[2].name == \"#US\" and \
+          dotnet.streams[3].name == \"#GUID\" and \
+          dotnet.streams[4].name == \"#Blob\" \
+      }",
+      "tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
+
+  assert_true_rule_file(
+      "import \"dotnet\" \
+      rule test { \
+        condition: \
+          dotnet.module_name == \"hpjsoaputility.Sv.resources.dll\" and \
+          dotnet.version == \"v2.0.50727\" \
+      }",
+      "tests/data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171");
+
+  yr_finalize();
+  return 0;
+}