mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
62 lines
2.2 KiB
C
62 lines
2.2 KiB
C
/*
|
|
Copyright (c) 2019. The YARA Authors. All Rights Reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without modification,
|
|
are permitted provided that the following conditions are met:
|
|
|
|
1. Redistributions of source code must retain the above copyright notice, this
|
|
list of conditions and the following disclaimer.
|
|
|
|
2. Redistributions in binary form must reproduce the above copyright notice,
|
|
this list of conditions and the following disclaimer in the documentation and/or
|
|
other materials provided with the distribution.
|
|
|
|
3. Neither the name of the copyright holder nor the names of its contributors
|
|
may be used to endorse or promote products derived from this software without
|
|
specific prior written permission.
|
|
|
|
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
|
|
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
|
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
|
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
|
|
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
|
|
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
|
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#include <yara.h>
|
|
#include "util.h"
|
|
|
|
|
|
int main(int argc, char** argv)
|
|
{
|
|
yr_initialize();
|
|
|
|
assert_true_rule_module_data_file(
|
|
"import \"pb_tests\" \
|
|
rule test { \
|
|
condition: \
|
|
pb_tests.f_int32 == 1111 and \
|
|
pb_tests.f_int64 == 2222 and \
|
|
pb_tests.f_string == \"foo\" and \
|
|
pb_tests.f_struct_array[0].f_enum == pb_tests.struct.enum.SECOND \
|
|
}",
|
|
"tests/data/test-pb.data.bin");
|
|
|
|
assert_true_rule_module_data_file(
|
|
"import \"pb_tests\" \
|
|
rule test { \
|
|
condition: \
|
|
for any s in pb_tests.f_struct_array : ( \
|
|
s.f_nested_struct.f_int32 == 3333 \
|
|
) \
|
|
}",
|
|
"tests/data/test-pb.data.bin");
|
|
|
|
yr_finalize();
|
|
return 0;
|
|
}
|