summaryrefslogtreecommitdiff
path: root/tests/analysis/scan/matches.py
blob: 768531b2a15c510a3fff2e3f8ada265554fdbab6 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

from common import RostTestClass
from pychrysalide.analysis.contents import MemoryContent


class TestRostMatchs(RostTestClass):
    """TestCases for the ROST pattern matching engine."""

    def testCountMatches(self):
        """Count matches patterns."""

        cnt = MemoryContent(b'aaa aaa bbb aaa')

        rule = '''
rule test {

   bytes:
      $a = "aaa"
      $b = "bbb"

   condition:
      #a == 3 and #b < 2

}
'''

        self.check_rule_success(rule, cnt)