gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-12 15:49:46 -08:00
Code Issues Packages Projects Releases Wiki Activity

tests: demonstrate instruct subscope rule extraction

Browse Source
This commit is contained in:
Willi Ballenthin
2022-03-28 13:04:13 -06:00
parent b0619f4f01
commit 46cc681eba
1 changed files with 27 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
tests/test_rules_insn_scope.py
View File

@@ -46,23 +46,34 @@ def test_rule_scope_instruction():
def test_rule_subscope_instruction():
capa.rules.Rule.from_yaml(
textwrap.dedent(
"""
rule:
meta:
name: test rule
scope: function
features:
- and:
- instruction:
- and:
- mnemonic: mov
- arch: i386
- os: windows
"""
)
rules = capa.rules.RuleSet(
[
capa.rules.Rule.from_yaml(
textwrap.dedent(
"""
rule:
meta:
name: test rule
scope: function
features:
- and:
- instruction:
- and:
- mnemonic: mov
- arch: i386
- os: windows
"""
)
)
]
)
# the function rule scope will have one rules:
# - `test rule`
assert len(rules.function_rules) == 1
# the insn rule scope have one rule:
# - the rule on which `test rule` depends
assert len(rules.instruction_rules) == 1
def test_scope_instruction_implied_and():