node-yara-rs

git clone git://archive.git.mtrnord.blog/MTRNord/node-yara-rs.git
Log | Files | Refs | README | LICENSE

index.spec.mjs (4874B)

      1 import test from 'ava'
      2 import { dirname, join } from 'path';
      3 import { fileURLToPath } from 'url';
      4 import * as fs from 'fs';
      5 import { YaraCompiler } from '../index.js'
      6 
      7 const TEST_RULE = "rule TestRule {\n    condition:\n        true\n}"
      8 const __dirname = dirname(fileURLToPath(import.meta.url));
      9 
     10 test('can construct YaraCompiler', (t) => {
     11   t.plan(1)
     12   t.notThrows(() => {
     13     const compiler = new YaraCompiler([], []);
     14   });
     15 })
     16 
     17 test('can load string rules', (t) => {
     18   t.plan(1)
     19   t.notThrows(() => {
     20     const compiler = new YaraCompiler([{
     21       string: TEST_RULE
     22     }], []);
     23   });
     24 })
     25 
     26 test('can match string rules', (t) => {
     27   t.plan(2)
     28   t.notThrows(() => {
     29     const compiler = new YaraCompiler([{
     30       string: TEST_RULE
     31     }], []);
     32     const scanner = compiler.newScanner();
     33     const result = scanner.scanString("");
     34     t.deepEqual(result, [
     35       {
     36         identifier: "TestRule",
     37         namespace: "default",
     38         metadatas: [],
     39         tags: [],
     40         strings: []
     41       }
     42     ])
     43   });
     44 })
     45 
     46 test('can load file based rules', (t) => {
     47   t.plan(1)
     48   t.notThrows(() => {
     49     const compiler = new YaraCompiler([{
     50       filename: join(__dirname, "./test.yara")
     51     }], []);
     52   });
     53 })
     54 
     55 
     56 test('can match file based rules', (t) => {
     57   t.plan(2)
     58   t.notThrows(() => {
     59     const compiler = new YaraCompiler([{
     60       filename: join(__dirname, "./test.yara")
     61     }], []);
     62     const scanner = compiler.newScanner();
     63     const result = scanner.scanString("Test");
     64     t.deepEqual(result, [
     65       {
     66         identifier: "TestRule",
     67         namespace: "default",
     68         metadatas: [
     69           {
     70             identifier: 'Author',
     71             value: 'MTRNord',
     72           },
     73           {
     74             identifier: 'Description',
     75             value: 'Test Rule',
     76           },
     77           {
     78             identifier: 'hash',
     79             value: '06fdc3d7d60da6b884fd69d7d1fd3c824ec417b2b7cdd40a7bb8c9fb72fb655b',
     80           },
     81           {
     82             identifier: 'Action',
     83             value: 'Notify',
     84           },
     85         ],
     86         tags: ["test_rule"],
     87         strings: [
     88           {
     89             identifier: '$test_string',
     90             matches: [
     91               {
     92                 base: 0,
     93                 data: [
     94                   84,
     95                   101,
     96                   115,
     97                   116
     98                 ],
     99                 length: 4,
    100                 offset: 0,
    101                 stringData: "Test"
    102               },
    103             ],
    104           },
    105         ]
    106       }
    107     ])
    108   });
    109 })
    110 
    111 if (process.platform !== "win32") {
    112   test('can match file based json rules', (t) => {
    113     const data = fs.readFileSync(join(__dirname, "./test.json"), 'utf8');
    114     t.plan(2)
    115     t.notThrows(() => {
    116       const compiler = new YaraCompiler([{
    117         filename: join(__dirname, "./json_test.yara")
    118       }, {
    119         filename: join(__dirname, "./test.yara")
    120       }], []);
    121       const scanner = compiler.newScanner();
    122       const result = scanner.scanString(data);
    123       t.deepEqual(result, [
    124         {
    125           identifier: "string_array_includes",
    126           namespace: "default",
    127           metadatas: [],
    128           tags: [],
    129           strings: []
    130         }, {
    131           identifier: "string_array_includes_nested",
    132           namespace: "default",
    133           metadatas: [],
    134           tags: [],
    135           strings: []
    136         }, {
    137           identifier: "integer_array_includes",
    138           namespace: "default",
    139           metadatas: [],
    140           tags: [],
    141           strings: []
    142         }, {
    143           identifier: "integer_array_includes_nested",
    144           namespace: "default",
    145           metadatas: [],
    146           tags: [],
    147           strings: []
    148         }, {
    149           identifier: "float_array_includes",
    150           namespace: "default",
    151           metadatas: [],
    152           tags: [],
    153           strings: []
    154         }, {
    155           identifier: "float_array_includes_nested",
    156           namespace: "default",
    157           metadatas: [],
    158           tags: [],
    159           strings: []
    160         }, {
    161           identifier: "dotted_key",
    162           namespace: "default",
    163           metadatas: [],
    164           tags: [],
    165           strings: []
    166         }, {
    167           identifier: "dotted_key_sub",
    168           namespace: "default",
    169           metadatas: [],
    170           tags: [],
    171           strings: []
    172         }, {
    173           identifier: "has_key_normal",
    174           namespace: "default",
    175           metadatas: [],
    176           tags: [],
    177           strings: []
    178         }, {
    179           identifier: "get_string",
    180           namespace: "default",
    181           metadatas: [],
    182           tags: [],
    183           strings: []
    184         }, {
    185           identifier: "get_integer",
    186           namespace: "default",
    187           metadatas: [],
    188           tags: [],
    189           strings: []
    190         }, {
    191           identifier: "get_float",
    192           namespace: "default",
    193           metadatas: [],
    194           tags: [],
    195           strings: []
    196         }
    197       ])
    198     });
    199   })
    200 }