mirror of
https://github.com/mandiant/capa.git
synced 2025-12-22 23:26:21 -08:00
add test for #78
This commit is contained in:
@@ -269,3 +269,31 @@ def test_byte_matching(sample_9324d1a8ae37a36ae560c37448c9705a):
|
|||||||
)
|
)
|
||||||
capabilities = capa.main.find_capabilities(rules, extractor)
|
capabilities = capa.main.find_capabilities(rules, extractor)
|
||||||
assert "byte match test" in capabilities
|
assert "byte match test" in capabilities
|
||||||
|
|
||||||
|
|
||||||
|
def test_count_bb(sample_9324d1a8ae37a36ae560c37448c9705a):
|
||||||
|
rules = capa.rules.RuleSet(
|
||||||
|
[
|
||||||
|
capa.rules.Rule.from_yaml(
|
||||||
|
textwrap.dedent(
|
||||||
|
"""
|
||||||
|
rule:
|
||||||
|
meta:
|
||||||
|
name: count bb
|
||||||
|
namespace: test
|
||||||
|
scope: function
|
||||||
|
features:
|
||||||
|
- and:
|
||||||
|
- count(basic blocks): 1 or more
|
||||||
|
"""
|
||||||
|
)
|
||||||
|
)
|
||||||
|
]
|
||||||
|
)
|
||||||
|
|
||||||
|
extractor = capa.features.extractors.viv.VivisectFeatureExtractor(
|
||||||
|
sample_9324d1a8ae37a36ae560c37448c9705a.vw, sample_9324d1a8ae37a36ae560c37448c9705a.path,
|
||||||
|
)
|
||||||
|
capabilities = capa.main.find_capabilities(rules, extractor)
|
||||||
|
assert "count bb" in capabilities
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user