def test_rule_with_match_offset_with_index_condition(self):
cond = yaramod.match_offset('$1', yaramod.int_val(0))
rule = self.new_rule \
.with_name('rule_with_match_offset_with_index_condition') \
.with_plain_string('$1', 'This is plain string 1.') \
.with_condition(cond.get()) \
.get()
yara_file = self.new_file \
.with_rule(rule) \
.get()
self.assertEqual(yara_file.text_formatted, '''rule rule_with_match_offset_with_index_condition
{
strings:
$1 = "This is plain string 1."
condition:
@1[0]
}
''')
self.assertEqual(yara_file.text, '''rule rule_with_match_offset_with_index_condition {
strings:
$1 = "This is plain string 1."
condition:
@1[0]
}''')
def test_rule_with_match_offset_condition(self):
cond = yaramod.match_offset('$1')
rule = self.new_rule \
.with_name('rule_with_match_offset_condition') \
.with_condition(cond.get()) \
.get()
yara_file = self.new_file \
.with_rule(rule) \
.get()
self.assertEqual(
yara_file.text, '''rule rule_with_match_offset_condition {
condition:
@1
}''')
