gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-22 07:10:29 -08:00
Code Issues Packages Projects Releases Wiki Activity

sync master

Browse Source
This commit is contained in:
Willi Ballenthin
2023-07-10 02:50:18 +02:00
parent d29e7140b6 1373fabf02
commit 72e123e319
84 changed files with 766 additions and 875 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tests/test_main.py
View File

@@ -10,8 +10,11 @@ import json
import textwrap
import fixtures
from fixtures import *
from fixtures import (
z499c2_extractor,
z9324d_extractor,
pma16_01_extractor,
pingtaest_extractor,
_692f_dotnetfile_extractor,
_1c444_dotnetfile_extractor,
_039a6_dotnetfile_extractor,
@@ -22,7 +25,6 @@ import capa.main
import capa.rules
import capa.engine
import capa.features
from capa.engine import *
def test_main(z9324d_extractor):
@@ -383,7 +385,7 @@ def test_instruction_scope(z9324d_extractor):
)
capabilities, meta = capa.main.find_capabilities(rules, z9324d_extractor)
assert "push 1000" in capabilities
assert 0x4071A4 in set(map(lambda result: result[0], capabilities["push 1000"]))
assert 0x4071A4 in {result[0] for result in capabilities["push 1000"]}
def test_instruction_subscope(z9324d_extractor):
@@ -413,7 +415,7 @@ def test_instruction_subscope(z9324d_extractor):
)
capabilities, meta = capa.main.find_capabilities(rules, z9324d_extractor)
assert "push 1000 on i386" in capabilities
assert 0x406F60 in set(map(lambda result: result[0], capabilities["push 1000 on i386"]))
assert 0x406F60 in {result[0] for result in capabilities["push 1000 on i386"]}
def test_fix262(pma16_01_extractor, capsys):
@@ -457,9 +459,9 @@ def test_json_meta(capsys):
std = capsys.readouterr()
std_json = json.loads(std.out)
assert {"type": "absolute", "value": 0x10001010} in list(
map(lambda f: f["address"], std_json["meta"]["analysis"]["layout"]["functions"])
)
assert {"type": "absolute", "value": 0x10001010} in [
f["address"] for f in std_json["meta"]["analysis"]["layout"]["functions"]
]
for addr, info in std_json["meta"]["analysis"]["layout"]["functions"]:
if addr == ["absolute", 0x10001010]: