From e065be67163ecd35c06e98247aa3bf30758c9b3c Mon Sep 17 00:00:00 2001
From: "Victor M. Alvarez" <vmalvarez@virustotal.com>
Date: Tue, 30 Jan 2024 21:32:02 +0100
Subject: [PATCH] Add test case for `magic` field in `macho` module.

This should confirm an issue with the endianness of `magic` field in big-endian platforms.
---
 tests/test-macho.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/test-macho.c b/tests/test-macho.c
index fe8eeab7..e890fc94 100644
--- a/tests/test-macho.c
+++ b/tests/test-macho.c
@@ -234,6 +234,12 @@ int main(int argc, char** argv)
     macho.file[1].cputype == macho.fat_arch[1].cputype }",
       "tests/data/tiny-universal");
 
+  assert_true_rule_file(
+      "import \"macho\" rule test { condition: \
+    macho.file[0].magic == 0xfeedface and \
+    macho.file[1].magic == 0xfeedfacf }",
+      "tests/data/tiny-universal");
+
   // Entry points for files (LC_MAIN)
 
   assert_true_rule_file(