diff --git a/tests/test_match.py b/tests/test_match.py index 7f69dc34..11551fde 100644 --- a/tests/test_match.py +++ b/tests/test_match.py @@ -531,3 +531,57 @@ def test_match_not_not(): _, matches = match([r], {capa.features.insn.Number(100): {1, 2}}, 0x0) assert "test rule" in matches + + +def test_match_operand_immediate(): + rule = textwrap.dedent( + """ + rule: + meta: + name: test rule + features: + - and: + - operand[0].immediate: 0x10 + """ + ) + r = capa.rules.Rule.from_yaml(rule) + + assert capa.features.insn.OperandImmediate(0, 0x10) in {capa.features.insn.OperandImmediate(0, 0x10)} + + _, matches = match([r], {capa.features.insn.OperandImmediate(0, 0x10): {1, 2}}, 0x0) + assert "test rule" in matches + + # mismatching index + _, matches = match([r], {capa.features.insn.OperandImmediate(1, 0x10): {1, 2}}, 0x0) + assert "test rule" not in matches + + # mismatching value + _, matches = match([r], {capa.features.insn.OperandImmediate(0, 0x11): {1, 2}}, 0x0) + assert "test rule" not in matches + + +def test_match_operand_offset(): + rule = textwrap.dedent( + """ + rule: + meta: + name: test rule + features: + - and: + - operand[0].offset: 0x10 + """ + ) + r = capa.rules.Rule.from_yaml(rule) + + assert capa.features.insn.OperandOffset(0, 0x10) in {capa.features.insn.OperandOffset(0, 0x10)} + + _, matches = match([r], {capa.features.insn.OperandOffset(0, 0x10): {1, 2}}, 0x0) + assert "test rule" in matches + + # mismatching index + _, matches = match([r], {capa.features.insn.OperandOffset(1, 0x10): {1, 2}}, 0x0) + assert "test rule" not in matches + + # mismatching value + _, matches = match([r], {capa.features.insn.OperandOffset(0, 0x11): {1, 2}}, 0x0) + assert "test rule" not in matches