forked from mandiant/flare-floss
-
Notifications
You must be signed in to change notification settings - Fork 0
/
test_language_extract_rust.py
82 lines (68 loc) · 3.99 KB
/
test_language_extract_rust.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
import pathlib
import pytest
from floss.results import StaticString, StringEncoding
from floss.language.rust.extract import extract_rust_strings
@pytest.fixture(scope="module")
def rust_strings32():
n = 6
path = pathlib.Path(__file__).parent / "data" / "language" / "rust" / "rust-hello" / "bin" / "rust-hello.exe"
return extract_rust_strings(path, n)
@pytest.fixture(scope="module")
def rust_strings64():
n = 6
path = pathlib.Path(__file__).parent / "data" / "language" / "rust" / "rust-hello" / "bin" / "rust-hello64.exe"
return extract_rust_strings(path, n)
@pytest.mark.parametrize(
"string,offset,encoding,rust_strings",
[
pytest.param("Hello, world!", 0xAD044, StringEncoding.UTF8, "rust_strings32"),
# .rdata:00000001400BD030 48 65 6C 6C 6F 2C aHelloWorld db 'Hello, world!',0Ah,0
# .rdata:00000001400BD03F 00 align 20h
# .rdata:00000001400BD040 ; const ___str_ pieces
# .rdata:00000001400BD040 30 D0 0B 40 01 00 pieces ___str_ <offset aHelloWorld, 0Eh>
# .rdata:00000001400BD040 00 00 00 00 ; "Hello, world!\n"
pytest.param("Hello, world!", 0xBB030, StringEncoding.UTF8, "rust_strings64"),
# .rdata:00000001400BD050 69 6E 76 61 6C 69 aInvalidArgs db 'invalid args',0
# .rdata:00000001400BD05D 00 00 00 align 20h
# .rdata:00000001400BD060 50 D0 0B 40 01 00 stru_1400BD060 ___str_ <offset aInvalidArgs, 0Ch>
# .rdata:00000001400BD060 00 00 00 00 ; "invalid args"
pytest.param("invalid args", 0xBB050, StringEncoding.UTF8, "rust_strings64"),
],
)
def test_data_string_offset(request, string, offset, encoding, rust_strings):
assert StaticString(string=string, offset=offset, encoding=encoding) in request.getfixturevalue(rust_strings)
@pytest.mark.parametrize(
"string,offset,encoding,rust_strings",
[
# .text:0000000140021155 4C 8D 05 2C DA 09 lea r8, aAccesserror ; "AccessError"
# .text:000000014002115C 48 8D 74 24 20 lea rsi, [rsp+38h+var_18]
# .text:0000000140021161 41 B9 0B 00 00 00 mov r9d, 11
pytest.param("AccessError", 0xBCB88, StringEncoding.UTF8, "rust_strings64"),
pytest.param("already destroyed", 0xBCB93, StringEncoding.UTF8, "rust_strings64"),
],
)
def test_lea_mov(request, string, offset, encoding, rust_strings):
assert StaticString(string=string, offset=offset, encoding=encoding) in request.getfixturevalue(rust_strings)
@pytest.mark.parametrize(
"string,offset,encoding,rust_strings",
[
# .text:0041EF8C 68 50 08 4B 00 push offset unk_4B0850 ; "AccessError"
# .text:0041EFB8 68 5B 08 4B 00 push offset unk_4B085B "already destroyed"
pytest.param("AccessError", 0xAE850, StringEncoding.UTF8, "rust_strings32"),
pytest.param("already destroyed", 0xAE85B, StringEncoding.UTF8, "rust_strings32"),
],
)
def test_push(request, string, offset, encoding, rust_strings):
assert StaticString(string=string, offset=offset, encoding=encoding) in request.getfixturevalue(rust_strings)
@pytest.mark.parametrize(
"string,offset,encoding,rust_strings",
[
# .text:0046B04A BA 1A 00 00 00 mov edx, 1Ah ; jumptable 0046A19C case 8752
# .text:0046B04F B9 A0 C2 4B 00 mov ecx, offset unk_4BC2A0
# .text:0046B054 E9 93 F8 FF FF jmp loc_46A8EC ; jumptable 0046A1CA case 0
pytest.param("DW_AT_SUN_return_value_ptr", 0xBA2A0, StringEncoding.UTF8, "rust_strings32"),
pytest.param("DW_AT_SUN_c_vla", 0xBA2BA, StringEncoding.UTF8, "rust_strings32"),
],
)
def test_mov_jmp(request, string, offset, encoding, rust_strings):
assert StaticString(string=string, offset=offset, encoding=encoding) in request.getfixturevalue(rust_strings)