|
| 1 | +package main |
| 2 | + |
| 3 | +import ( |
| 4 | + "testing" |
| 5 | + |
| 6 | + "github.com/dlclark/regexp2" |
| 7 | + "github.com/hillu/go-yara/v4" |
| 8 | +) |
| 9 | + |
| 10 | +func TestFindInFilesContent(t *testing.T) { |
| 11 | + p := []string{"TestFindInFilesContent"} |
| 12 | + r1 := checkForStringPattern("", []byte(p[0]), p) |
| 13 | + r2 := CheckFileChecksumAndContent("", []byte(p[0]), []string{}, p) |
| 14 | + if len(r1) != 1 || len(r2) != 1 { |
| 15 | + t.Fatal("checkForStringPattern or CheckFileChecksumAndContent doesn't match content in files") |
| 16 | + } |
| 17 | +} |
| 18 | + |
| 19 | +func TestFindFileChecksum(t *testing.T) { |
| 20 | + p := []string{"TestFindInFilesContent"} |
| 21 | + r1 := checkForChecksum("", []byte(p[0]), []string{"98073143a031423fd912da2c646d4aeb"}) |
| 22 | + r2 := checkForChecksum("", []byte(p[0]), []string{"7c6c8c4e28098e526be3ad183343a9868515d84e"}) |
| 23 | + r3 := checkForChecksum("", []byte(p[0]), []string{"3f0cc1212847f71146ee33e1e879588c328348aa0c0327c6ef4e0cfb13114cb8"}) |
| 24 | + |
| 25 | + if len(r1) != 1 || len(r2) != 1 || len(r3) != 1 { |
| 26 | + t.Fatal("checkForChecksum fails find hash in content") |
| 27 | + } |
| 28 | + |
| 29 | + r4 := CheckFileChecksumAndContent("", []byte(p[0]), []string{"98073143a031423fd912da2c646d4aeb"}, []string{}) |
| 30 | + r5 := CheckFileChecksumAndContent("", []byte(p[0]), []string{"7c6c8c4e28098e526be3ad183343a9868515d84e"}, []string{}) |
| 31 | + r6 := CheckFileChecksumAndContent("", []byte(p[0]), []string{"3f0cc1212847f71146ee33e1e879588c328348aa0c0327c6ef4e0cfb13114cb8"}, []string{}) |
| 32 | + |
| 33 | + if len(r4) != 1 || len(r5) != 1 || len(r6) != 1 { |
| 34 | + t.Fatal("CheckFileChecksumAndContent fails using checkForChecksum and matchs hash in content") |
| 35 | + } |
| 36 | +} |
| 37 | + |
| 38 | +func TestFindWithYARA(t *testing.T) { |
| 39 | + compiler, err := yara.NewCompiler() |
| 40 | + if err != nil { |
| 41 | + t.Fatal("Fail to instanciate YARA compiler") |
| 42 | + } |
| 43 | + |
| 44 | + compiler.AddString("rule testing{\r\n\tstrings:\r\n\t\t$ = \"TestFindInFilesContent\"\r\n\tcondition:\r\n\t\tall of them\r\n}", "testing") |
| 45 | + r, err := compiler.GetRules() |
| 46 | + if err != nil { |
| 47 | + t.Fatal("Fail to compile YARA rules") |
| 48 | + } |
| 49 | + |
| 50 | + p := []byte("TestFindInFilesContent") |
| 51 | + r1, err := PerformYaraScan(&p, r) |
| 52 | + if err != nil || len(r1) != 1 { |
| 53 | + t.Fatal("PerformYaraScan fails to find string with YARA") |
| 54 | + } |
| 55 | + |
| 56 | + f := []string{"finder_test.go"} |
| 57 | + r2 := *FindInFilesContent(&f, []string{}, r, []string{}, false, 512, 512) |
| 58 | + if len(r2) != 1 { |
| 59 | + t.Fatal("FindInFilesContent fails to return YARA match") |
| 60 | + } |
| 61 | +} |
| 62 | + |
| 63 | +func TestPathMatching(t *testing.T) { |
| 64 | + var re []*regexp2.Regexp |
| 65 | + f := []string{"finder_test.go"} |
| 66 | + re = append(re, regexp2.MustCompile("finder_test\\.go", regexp2.IgnoreCase)) |
| 67 | + r1 := PathsFinder(&f, re) |
| 68 | + |
| 69 | + if len(*r1) != 1 { |
| 70 | + t.Fatal("PathsFinder fails to match path with regex") |
| 71 | + } |
| 72 | +} |
0 commit comments