Extend the ROST grammar with a first batch of new features.

1 files changed, 27 insertions, 0 deletions

diff --git a/tests/analysis/scan/matches.py b/tests/analysis/scan/matches.py
new file mode 100644
index 0000000..0d7556e
--- /dev/null
+++ b/tests/analysis/scan/matches.py
@@ -0,0 +1,27 @@
+
+from common import RostTestClass
+from pychrysalide.analysis.contents import MemoryContent
+
+
+class TestRostMatchs(RostTestClass):
+    """TestCases for the ROST pattern matching engine."""
+
+    def testCountMatches(self):
+        """Count matches patterns."""
+
+        cnt = MemoryContent(b'aaa aaa bbb aaa')
+
+        rule = '''
+rule test {
+
+   strings:
+      $a = "aaa"
+      $b = "bbb"
+
+   condition:
+      #a == 3 and #b < 2
+
+}
+'''
+
+        self.check_rule_success(rule, cnt)