示例#1
0
    def test_rule_with_dictionary_access_condition(self):
        cond = yaramod.id('pe').access('version_info')[yaramod.string_val('CompanyName')]
        rule = self.new_rule \
            .with_name('rule_with_dictionary_access_condition') \
            .with_condition(cond.get()) \
            .get()
        yara_file = self.new_file \
            .with_module('pe') \
            .with_rule(rule) \
            .get()

        self.assertEqual(yara_file.text_formatted, '''import "pe"

rule rule_with_dictionary_access_condition
{
	condition:
		pe.version_info["CompanyName"]
}
''')
        self.assertEqual(yara_file.text, '''import "pe"

rule rule_with_dictionary_access_condition {
	condition:
		pe.version_info["CompanyName"]
}''')
示例#2
0
    def test_rule_with_for_loop_over_dictionary(self):
        cond = yaramod.for_loop(
                yaramod.any(),
                'k',
                'v',
                yaramod.id('pe').access('version_info'),
                yaramod.conjunction([
                    yaramod.id('k') == yaramod.string_val('CompanyName'),
                    yaramod.id('v').contains(yaramod.string_val('Microsoft'))
                ])
            )
        rule = self.new_rule \
            .with_name('rule_with_for_loop_over_dictionary') \
            .with_plain_string('$1', 'This is plain string.') \
            .with_condition(cond.get()) \
            .get()
        yara_file = self.new_file \
            .with_rule(rule) \
            .get()


        self.assertEqual(yara_file.text_formatted, '''rule rule_with_for_loop_over_dictionary
{
	strings:
		$1 = "This is plain string."
	condition:
		for any k, v in pe.version_info : (
			k == "CompanyName" and
			v contains "Microsoft"
		)
}
''')
        self.assertEqual(yara_file.text, '''rule rule_with_for_loop_over_dictionary {
	strings:
		$1 = "This is plain string."
	condition:
		for any k, v in pe.version_info : ( k == "CompanyName" and v contains "Microsoft" )
}''')