gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-22 23:26:21 -08:00
Code Issues Packages Projects Releases Wiki Activity

Remove True from Characteristic rules and output

Browse Source 
Get rid of `True` in characteristic (rules, output and json) as it is
implicit. This way, the same syntax is used for characteristic as for
the rest of the features.

Co-authored-by: William Ballenthin <william.ballenthin@fireeye.com>
This commit is contained in:
Ana María Martínez Gómez
2020-07-01 19:40:50 +02:00
parent 681feebf35
commit 64124c0b64
17 changed files with 125 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
tests/test_main.py
View File

@@ -42,7 +42,7 @@ def test_ruleset():
name: file rule
scope: file
features:
- characteristic(embedded pe): y
- characteristic: embedded pe
''')),
capa.rules.Rule.from_yaml(textwrap.dedent('''
rule:
@@ -50,7 +50,7 @@ def test_ruleset():
name: function rule
scope: function
features:
- characteristic(switch): y
- characteristic: switch
''')),
capa.rules.Rule.from_yaml(textwrap.dedent('''
rule:
@@ -58,7 +58,7 @@ def test_ruleset():
name: basic block rule
scope: basic block
features:
- characteristic(nzxor): y
- characteristic: nzxor
''')),
])
@@ -128,7 +128,7 @@ def test_match_across_scopes(sample_9324d1a8ae37a36ae560c37448c9705a):
examples:
- 9324d1a8ae37a36ae560c37448c9705a:0x403685
features:
- characteristic(tight loop): true
- characteristic: tight loop
''')),
# this rule should match on a function (0x403660)
# based on API, as well as prior basic block rule match
@@ -176,7 +176,7 @@ def test_subscope_bb_rules(sample_9324d1a8ae37a36ae560c37448c9705a):
features:
- and:
- basic block:
- characteristic(tight loop): true
- characteristic: tight loop
'''))
])
# tight loop at 0x403685