vee1e/capa
1
0
Fork 0
mirror of https://github.com/vee1e/capa.git synced 2026-09-01 18:57:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

tests: demonstrate OperandOffset and OperandImmediate

Browse source
This commit is contained in:
Willi Ballenthin 2022-03-30 13:13:50 -06:00
parent 6cbbd4d97f
commit c7aadca25c
No known key found for this signature in database
1 changed files with 54 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

54
tests/test_match.py
View file

@ -531,3 +531,57 @@ def test_match_not_not():
_, matches = match([r], {capa.features.insn.Number(100): {1, 2}}, 0x0)
assert "test rule" in matches
def test_match_operand_immediate():
rule = textwrap.dedent(
"""
rule:
meta:
name: test rule
features:
- and:
- operand[0].immediate: 0x10
"""
)
r = capa.rules.Rule.from_yaml(rule)
assert capa.features.insn.OperandImmediate(0, 0x10) in {capa.features.insn.OperandImmediate(0, 0x10)}
_, matches = match([r], {capa.features.insn.OperandImmediate(0, 0x10): {1, 2}}, 0x0)
assert "test rule" in matches
# mismatching index
_, matches = match([r], {capa.features.insn.OperandImmediate(1, 0x10): {1, 2}}, 0x0)
assert "test rule" not in matches
# mismatching value
_, matches = match([r], {capa.features.insn.OperandImmediate(0, 0x11): {1, 2}}, 0x0)
assert "test rule" not in matches
def test_match_operand_offset():
rule = textwrap.dedent(
"""
rule:
meta:
name: test rule
features:
- and:
- operand[0].offset: 0x10
"""
)
r = capa.rules.Rule.from_yaml(rule)
assert capa.features.insn.OperandOffset(0, 0x10) in {capa.features.insn.OperandOffset(0, 0x10)}
_, matches = match([r], {capa.features.insn.OperandOffset(0, 0x10): {1, 2}}, 0x0)
assert "test rule" in matches
# mismatching index
_, matches = match([r], {capa.features.insn.OperandOffset(1, 0x10): {1, 2}}, 0x0)
assert "test rule" not in matches
# mismatching value
_, matches = match([r], {capa.features.insn.OperandOffset(0, 0x11): {1, 2}}, 0x0)
assert "test rule" not in matches