blob: e009b792097e2ede8307d79e4efa7cec055d9d76 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
from common import RostTestClass
from pychrysalide.analysis.contents import MemoryContent
class TestRostScanning(RostTestClass):
"""TestCases for the bytes section syntax."""
def testSimpleHexPattern(self):
"""Test a simple hex pattern."""
cnt = MemoryContent(b'123-Abc-456')
rule = '''
rule test {
strings:
$a = { 41 62 63 }
condition:
#a == 1 and @a[0] == 4
}
'''
self.check_rule_success(rule, content=cnt)
|
