This commit is contained in:
William Ballenthin
2021-11-10 12:51:27 -07:00
parent 845df282ef
commit 2d68fb2536
3 changed files with 12 additions and 14 deletions

View File

@@ -51,14 +51,14 @@ def test_match_simple():
"""
)
r = capa.rules.Rule.from_yaml(rule)
features, matches = match([r], {capa.features.insn.Number(100): {1, 2}}, 0x0)
assert "test rule" in matches
assert MatchedRule("test rule") in features
assert MatchedRule("testns1") in features
assert MatchedRule("testns1/testns2") in features
def test_match_range_exact():
rule = textwrap.dedent(
"""
@@ -225,7 +225,7 @@ def test_match_matched_rules():
assert capa.features.common.MatchedRule("test rule1") in features
assert capa.features.common.MatchedRule("test rule2") in features
def test_match_namespace():
rules = [
capa.rules.Rule.from_yaml(
@@ -296,7 +296,6 @@ def test_match_namespace():
assert "WriteFile API" in matches
assert "file-create" not in matches
assert "filesystem-any" in matches
def test_match_substring():
@@ -495,8 +494,8 @@ def test_match_regex_values_always_string():
0x0,
)
assert capa.features.common.MatchedRule("test rule") in features
def test_match_not():
rule = textwrap.dedent(
"""
@@ -510,11 +509,11 @@ def test_match_not():
"""
)
r = capa.rules.Rule.from_yaml(rule)
_, matches = match([r], {capa.features.insn.Number(100): {1, 2}}, 0x0)
assert "test rule" in matches
def test_match_not_not():
rule = textwrap.dedent(
"""
@@ -529,6 +528,6 @@ def test_match_not_not():
"""
)
r = capa.rules.Rule.from_yaml(rule)
_, matches = match([r], {capa.features.insn.Number(100): {1, 2}}, 0x0)
assert "test rule" in matches

View File

@@ -2,9 +2,10 @@ import textwrap
import capa.rules
import capa.render.utils
import capa.render.result_document
import capa.features.insn
import capa.features.common
import capa.render.result_document
def test_render_number():
assert str(capa.features.insn.Number(1)) == "number(0x1)"
@@ -16,7 +17,7 @@ def test_render_offset():
assert str(capa.features.insn.Offset(1)) == "offset(0x1)"
assert str(capa.features.insn.Offset(1, bitness=capa.features.common.BITNESS_X32)) == "offset/x32(0x1)"
assert str(capa.features.insn.Offset(1, bitness=capa.features.common.BITNESS_X64)) == "offset/x64(0x1)"
def test_render_meta_attack():
# Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]

View File

@@ -785,8 +785,6 @@ def test_substring_description():
assert (Substring("abc") in children) == True
def test_filter_rules():
rules = capa.rules.RuleSet(
[