VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add test cases for some yr_atoms_heuristic_quality.

Browse Source
This commit is contained in:
Victor M. Alvarez
2021-08-26 16:06:04 +02:00
parent e3d6a4dd1a
commit cefc520b58
1 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test-atoms.c
+40
View File
@@ -131,6 +131,31 @@ void test_heuristic_quality()
.bytes = {0x01, 0x02, 0x03, 0x04},
.mask = {0xFF, 0xFF, 0x00, 0xFF}};
YR_ATOM a90909090 = {
.length = 4,
.bytes = {0x90, 0x90, 0x90, 0x90},
.mask = {0xFF, 0xFF, 0xFF, 0xFF}};
YR_ATOM a20202020 = {
.length = 4,
.bytes = {0x20, 0x20, 0x20, 0x20},
.mask = {0xFF, 0xFF, 0xFF, 0xFF}};
YR_ATOM aCCCCCCCC = {
.length = 4,
.bytes = {0xCC, 0xCC, 0xCC, 0xCC},
.mask = {0xFF, 0xFF, 0xFF, 0xFF}};
YR_ATOM aFFFFFFFF = {
.length = 4,
.bytes = {0xFF, 0xFF, 0xFF, 0xFF},
.mask = {0xFF, 0xFF, 0xFF, 0xFF}};
YR_ATOM a01010101 = {
.length = 4,
.bytes = {0x01, 0x01, 0x01, 0x01},
.mask = {0xFF, 0xFF, 0xFF, 0xFF}};
c.get_atom_quality = yr_atoms_heuristic_quality;
int q00000000 = yr_atoms_heuristic_quality(&c, &a00000000);
@@ -146,6 +171,11 @@ void test_heuristic_quality()
int q000102 = yr_atoms_heuristic_quality(&c, &a000102);
int q01020000 = yr_atoms_heuristic_quality(&c, &a01020000);
int q0102XX04 = yr_atoms_heuristic_quality(&c, &a0102XX04);
int q01010101 = yr_atoms_heuristic_quality(&c, &a01010101);
int q20202020 = yr_atoms_heuristic_quality(&c, &a20202020);
int q90909090 = yr_atoms_heuristic_quality(&c, &a90909090);
int qCCCCCCCC = yr_atoms_heuristic_quality(&c, &aCCCCCCCC);
int qFFFFFFFF = yr_atoms_heuristic_quality(&c, &aFFFFFFFF);
a010203.mask[1] = 0x00;
@@ -185,6 +215,16 @@ void test_heuristic_quality()
assert_true_expr(q010X0X < q010203);
assert_true_expr(q01020000 > q0102XX04);
// Byte sequences like 90 90 90 90 and CC CC CC CC are using as function
// padding by compilers (sequences of NOP and INT 3 instructions respectively)
// and therefore are very common. FF FF FF FF and 20 20 20 20 (spaces) are
// also very common sequences. All these common sequences are penalized and
// have lower qualities than 01 01 01 01.
assert_true_expr(q90909090 < q01010101);
assert_true_expr(q20202020 < q01010101);
assert_true_expr(qCCCCCCCC < q01010101);
assert_true_expr(qFFFFFFFF < q01010101);
assert_true_expr(q01020304 == YR_MAX_ATOM_QUALITY);
}