NAME=yara: list
FILE=malloc://1024
CMDS=<<EOF
yr-
yr ../rules/crypto.yara
yrl
EOF
EXPECT=<<EOF
BLOWFISH_Constants
MD5_Constants
RC6_Constants
RIPEMD160_Constants
SHA1_Constants
SHA256_Constants
SHA512_Constants
WHIRLPOOL_Constants
EOF
RUN

NAME=yara: tags
FILE=malloc://1024
CMDS=<<EOF
yrt
EOF
EXPECT=<<EOF
[YARA tags]
crypto
foo
EOF
RUN

NAME=yara scan
FILE=bins/elf/vim
ARGS=-n
CMDS=<<EOF
yr-
yr ../rules/crypto.yara
yrs
f
EOF
EXPECT=<<EOF
BLOWFISH_Constants
0x002960c0: yara0.BLOWFISH_Constants_0 : a60b31d1
0x002960c4: yara0.BLOWFISH_Constants_1 : acb5df98
0x002960c8: yara0.BLOWFISH_Constants_2 : db72fd2f
0x002960cc: yara0.BLOWFISH_Constants_3 : b7df1ad0
0x002964c0: yara0.BLOWFISH_Constants_4 : e9707a4b
0x002968c8: yara0.BLOWFISH_Constants_5 : 1c264cf6
SHA256_Constants
0x001936c4: yara1.SHA256_Constants_0 : 982f8a42
0x0019372b: yara1.SHA256_Constants_1 : 91443771
0x0019379d: yara1.SHA256_Constants_2 : cffbc0b5
0x001937e5: yara1.SHA256_Constants_3 : a5dbb5e9
0x001936c4 4 yara1.SHA256_Constants_0
0x0019372b 4 yara1.SHA256_Constants_1
0x0019379d 4 yara1.SHA256_Constants_2
0x001937e5 4 yara1.SHA256_Constants_3
0x002960c0 4 yara0.BLOWFISH_Constants_0
0x002960c4 4 yara0.BLOWFISH_Constants_1
0x002960c8 4 yara0.BLOWFISH_Constants_2
0x002960cc 4 yara0.BLOWFISH_Constants_3
0x002964c0 4 yara0.BLOWFISH_Constants_4
0x002968c8 4 yara0.BLOWFISH_Constants_5
EOF
RUN

NAME=yara: scan with strings
FILE=malloc://1024
CMDS=<<EOF
wx cffbc0b5e9b5dba5a5dbb5e9d728ae2222ae28d7
yr/
EOF
EXPECT=<<EOF
SHA512_Constants
0x00000000: yara0.SHA512_Constants_0 : cffbc0b5
0x00000004: yara0.SHA512_Constants_1 : e9b5dba5
0x00000008: yara0.SHA512_Constants_2 : a5dbb5e9
0x0000000c: yara0.SHA512_Constants_3 : d728ae22
0x00000010: yara0.SHA512_Constants_4 : 22ae28d7
EOF
RUN

NAME=yara: long scan modes
FILE=malloc://32
CMDS=<<EOF
yr-
w Test
yrgs
yr+
yara scan
yara scanS
EOF
EXPECT=<<EOF
rulename
rulename
0x00000000: yara1.rulename_0 : 54657374
EOF
RUN

NAME=yara: versions
FILE=malloc://1024
CMDS=<<EOF
yrv~yara?
yara version~yara?
EOF
EXPECT=<<EOF
2
2
EOF
RUN

NAME=yr+
FILE=malloc://1024
CMDS=<<EOF
yr-
e yara.rule = test
w Test
yrgs
yr+
yrl
EOF
EXPECT=<<EOF
test
EOF
RUN

NAME=yrgs with length
FILE=malloc://1024
CMDS=<<EOF
yr-
w 4d79207061747465726e010203040506
s 100
w 4d79207061747465726ef1f2f3f4
yrgs 10
yr+
yrs
EOF
EXPECT=<<EOF
rulename
0x00000000: yara0.rulename_0 : 34643739323037303631
0x00000064: yara0.rulename_1 : 34643739323037303631
EOF
RUN

