Skip to content

Commit

Permalink
Remove files used for testing purposes that were being detected by an…
Browse files Browse the repository at this point in the history
…tivirus programs. Remove .exe extension from some other files.
  • Loading branch information
plusvic committed Sep 6, 2016
1 parent 7473441 commit c857145
Show file tree
Hide file tree
Showing 7 changed files with 3 additions and 32 deletions.
Binary file removed tests/data/cdak_1024x768.exe
Binary file not shown.
Binary file removed tests/data/old_ArmaFP.exe
Binary file not shown.
File renamed without changes.
File renamed without changes.
File renamed without changes.
6 changes: 3 additions & 3 deletions tests/test-pe.c
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@ int main(int argc, char** argv)
yr_initialize();

assert_true_rule_file("import \"pe\" rule test { condition: pe.imports(\"KERNEL32.dll\", \"DeleteCriticalSection\") }",
"tests/data/tiny.exe");
"tests/data/tiny");

assert_true_rule_file("import \"pe\" rule test { condition: pe.imports(\"KERNEL32.dll\", \"DeleteCriticalSection\") }",
"tests/data/tiny-idata-51ff.exe");
"tests/data/tiny-idata-51ff");

assert_false_rule_file("import \"pe\" rule test { condition: pe.imports(\"KERNEL32.dll\", \"DeleteCriticalSection\") }",
"tests/data/tiny-idata-5200.exe");
"tests/data/tiny-idata-5200");

yr_finalize();
return 0;
Expand Down
29 changes: 0 additions & 29 deletions tests/test-rules.c
Original file line number Diff line number Diff line change
Expand Up @@ -1034,35 +1034,6 @@ static void test_entrypoint()
assert_false_rule(
"rule test { condition: entrypoint >= 0 }",
NULL);

/* https://github.com/VirusTotal/yara/issues/373 */
assert_true_rule_file(
"import \"pe\" \
rule test { \
condition: pe.entry_point == 0x18 }",
"tests/data/old_ArmaFP.exe");

assert_true_rule_file(
"import \"pe\" \
rule test { \
strings: $right = { BE B0 11 40 00 } \
condition: $right at pe.entry_point }",
"tests/data/old_ArmaFP.exe");
/* $wrong = { 0B 01 4C 6F 61 64 4C } */

/* https://github.com/VirusTotal/yara/issues/399 */
assert_true_rule_file(
"import \"pe\" \
rule test { \
condition: pe.entry_point == 2 }",
"tests/data/cdak_1024x768.exe");

assert_true_rule_file(
"import \"pe\" \
rule test { \
strings: $a0 = { 68 00 00 42 00 31 C0 40 EB 58 } \
condition: $a0 at pe.entry_point }",
"tests/data/cdak_1024x768.exe");
}


Expand Down

0 comments on commit c857145

Please sign in to comment.