mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
Wesley Shields
87bc03d587
As mentioned in #1454, this makes checking the distance between two matches regardless of the order of matches easier.
73 lines
1.3 KiB
C
73 lines
1.3 KiB
C
#include <stdio.h>
|
|
#include <yara.h>
|
|
|
|
#include "util.h"
|
|
|
|
int main(int argc, char** argv)
|
|
{
|
|
int result = 0;
|
|
|
|
YR_DEBUG_INITIALIZE();
|
|
YR_DEBUG_FPRINTF(1, stderr, "+ %s() { // in %s\n", __FUNCTION__, argv[0]);
|
|
|
|
yr_initialize();
|
|
|
|
assert_true_rule_blob(
|
|
"import \"math\" \
|
|
rule test { \
|
|
condition: \
|
|
math.min(0, 1) == 0 \
|
|
}",
|
|
"A");
|
|
|
|
assert_true_rule_blob(
|
|
"import \"math\" \
|
|
rule test { \
|
|
condition: \
|
|
math.max(0, 1) == 1 \
|
|
}",
|
|
"A");
|
|
|
|
assert_true_rule_blob(
|
|
"import \"math\" \
|
|
rule test { \
|
|
condition: \
|
|
math.to_number(1 == 1) \
|
|
}",
|
|
"A");
|
|
|
|
assert_false_rule_blob(
|
|
"import \"math\" \
|
|
rule test { \
|
|
condition: \
|
|
math.to_number(1 > 2) \
|
|
}",
|
|
"A");
|
|
|
|
assert_true_rule_blob(
|
|
"import \"math\" \
|
|
rule test { \
|
|
condition: \
|
|
math.abs(-1) == 1 \
|
|
}",
|
|
"A");
|
|
|
|
assert_true_rule_blob(
|
|
"import \"math\" \
|
|
rule test { \
|
|
strings: \
|
|
$a = \"A\" \
|
|
$b = \"B\" \
|
|
condition: \
|
|
math.abs(@a - @b) == 1 \
|
|
}",
|
|
"AB");
|
|
|
|
yr_finalize();
|
|
|
|
YR_DEBUG_FPRINTF(
|
|
1, stderr, "} = %d // %s() in %s\n", result, __FUNCTION__, argv[0]);
|
|
|
|
return result;
|
|
}
|