diff --git a/tests/test-atoms.c b/tests/test-atoms.c index 6d47904d..bc44cd35 100644 --- a/tests/test-atoms.c +++ b/tests/test-atoms.c @@ -131,6 +131,31 @@ void test_heuristic_quality() .bytes = {0x01, 0x02, 0x03, 0x04}, .mask = {0xFF, 0xFF, 0x00, 0xFF}}; + YR_ATOM a90909090 = { + .length = 4, + .bytes = {0x90, 0x90, 0x90, 0x90}, + .mask = {0xFF, 0xFF, 0xFF, 0xFF}}; + + YR_ATOM a20202020 = { + .length = 4, + .bytes = {0x20, 0x20, 0x20, 0x20}, + .mask = {0xFF, 0xFF, 0xFF, 0xFF}}; + + YR_ATOM aCCCCCCCC = { + .length = 4, + .bytes = {0xCC, 0xCC, 0xCC, 0xCC}, + .mask = {0xFF, 0xFF, 0xFF, 0xFF}}; + + YR_ATOM aFFFFFFFF = { + .length = 4, + .bytes = {0xFF, 0xFF, 0xFF, 0xFF}, + .mask = {0xFF, 0xFF, 0xFF, 0xFF}}; + + YR_ATOM a01010101 = { + .length = 4, + .bytes = {0x01, 0x01, 0x01, 0x01}, + .mask = {0xFF, 0xFF, 0xFF, 0xFF}}; + c.get_atom_quality = yr_atoms_heuristic_quality; int q00000000 = yr_atoms_heuristic_quality(&c, &a00000000); @@ -146,6 +171,11 @@ void test_heuristic_quality() int q000102 = yr_atoms_heuristic_quality(&c, &a000102); int q01020000 = yr_atoms_heuristic_quality(&c, &a01020000); int q0102XX04 = yr_atoms_heuristic_quality(&c, &a0102XX04); + int q01010101 = yr_atoms_heuristic_quality(&c, &a01010101); + int q20202020 = yr_atoms_heuristic_quality(&c, &a20202020); + int q90909090 = yr_atoms_heuristic_quality(&c, &a90909090); + int qCCCCCCCC = yr_atoms_heuristic_quality(&c, &aCCCCCCCC); + int qFFFFFFFF = yr_atoms_heuristic_quality(&c, &aFFFFFFFF); a010203.mask[1] = 0x00; @@ -185,6 +215,16 @@ void test_heuristic_quality() assert_true_expr(q010X0X < q010203); assert_true_expr(q01020000 > q0102XX04); + // Byte sequences like 90 90 90 90 and CC CC CC CC are using as function + // padding by compilers (sequences of NOP and INT 3 instructions respectively) + // and therefore are very common. FF FF FF FF and 20 20 20 20 (spaces) are + // also very common sequences. All these common sequences are penalized and + // have lower qualities than 01 01 01 01. + assert_true_expr(q90909090 < q01010101); + assert_true_expr(q20202020 < q01010101); + assert_true_expr(qCCCCCCCC < q01010101); + assert_true_expr(qFFFFFFFF < q01010101); + assert_true_expr(q01020304 == YR_MAX_ATOM_QUALITY); }