1 /*
2 Copyright (c) 2014. The YARA Authors. All Rights Reserved.
3
4 Redistribution and use in source and binary forms, with or without modification,
5 are permitted provided that the following conditions are met:
6
7 1. Redistributions of source code must retain the above copyright notice, this
8 list of conditions and the following disclaimer.
9
10 2. Redistributions in binary form must reproduce the above copyright notice,
11 this list of conditions and the following disclaimer in the documentation and/or
12 other materials provided with the distribution.
13
14 3. Neither the name of the copyright holder nor the names of its contributors
15 may be used to endorse or promote products derived from this software without
16 specific prior written permission.
17
18 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
19 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
22 ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25 ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30 #include <yara/modules.h>
31
32 #define MODULE_NAME tests
33
34
define_function(fsum_2)35 define_function(fsum_2)
36 {
37 double a = float_argument(1);
38 double b = float_argument(2);
39
40 return_float(a + b);
41 }
42
define_function(fsum_3)43 define_function(fsum_3)
44 {
45 double a = float_argument(1);
46 double b = float_argument(2);
47 double c = float_argument(3);
48
49 return_float(a + b + c);
50 }
51
define_function(isum_2)52 define_function(isum_2)
53 {
54 int64_t a = integer_argument(1);
55 int64_t b = integer_argument(2);
56
57 return_integer(a + b);
58 }
59
60
define_function(isum_3)61 define_function(isum_3)
62 {
63 int64_t a = integer_argument(1);
64 int64_t b = integer_argument(2);
65 int64_t c = integer_argument(3);
66
67 return_integer(a + b + c);
68 }
69
70
define_function(length)71 define_function(length)
72 {
73 char* s = string_argument(1);
74
75 return_integer(strlen(s));
76 }
77
78
define_function(empty)79 define_function(empty)
80 {
81 return_string("");
82 }
83
84
define_function(match)85 define_function(match)
86 {
87 return_integer(
88 yr_re_match(scan_context(), regexp_argument(1), string_argument(2)));
89 }
90
91
define_function(foobar)92 define_function(foobar)
93 {
94 int64_t arg = integer_argument(1);
95
96 switch (arg)
97 {
98 case 1:
99 return_string("foo");
100 break;
101 case 2:
102 return_string("bar");
103 break;
104 }
105
106 return_string("oops")
107 }
108
109 begin_declarations
110 begin_struct("constants")
111 declare_integer("one");
112 declare_integer("two");
113 declare_string("foo");
114 declare_string("empty");
115 end_struct("constants")
116
117 begin_struct("undefined")
118 declare_integer("i");
119 declare_float("f");
120 end_struct("undefined")
121
122 declare_string("module_data");
123 declare_integer_array("integer_array");
124 declare_string_array("string_array");
125
126 declare_integer_dictionary("integer_dict");
127 declare_string_dictionary("string_dict");
128
129 begin_struct_array("struct_array")
130 declare_integer("i");
131 declare_string("s");
132 end_struct_array("struct_array")
133
134 begin_struct_dictionary("struct_dict")
135 declare_integer("i");
136 declare_string("s");
137 end_struct_dictionary("struct_dict");
138
139 begin_struct_dictionary("empty_struct_dict")
140 declare_integer("unused");
141 end_struct_dictionary("empty_struct_dict")
142
143 declare_function("match", "rs", "i", match);
144 declare_function("isum", "ii", "i", isum_2);
145 declare_function("isum", "iii", "i", isum_3);
146 declare_function("fsum", "ff", "f", fsum_2);
147 declare_function("fsum", "fff", "f", fsum_3);
148 declare_function("length", "s", "i", length);
149 declare_function("empty", "", "s", empty);
150 declare_function("foobar", "i", "s", foobar);
151 end_declarations
152
153
module_initialize(YR_MODULE * module)154 int module_initialize(YR_MODULE* module)
155 {
156 return ERROR_SUCCESS;
157 }
158
159
module_finalize(YR_MODULE * module)160 int module_finalize(YR_MODULE* module)
161 {
162 return ERROR_SUCCESS;
163 }
164
module_load(YR_SCAN_CONTEXT * context,YR_OBJECT * module_object,void * module_data,size_t module_data_size)165 int module_load(
166 YR_SCAN_CONTEXT* context,
167 YR_OBJECT* module_object,
168 void* module_data,
169 size_t module_data_size)
170 {
171 set_integer(1, module_object, "constants.one");
172 set_integer(2, module_object, "constants.two");
173 set_string("foo", module_object, "constants.foo");
174 set_string("", module_object, "constants.empty");
175
176 set_integer(1, module_object, "struct_array[1].i");
177
178 set_integer(0, module_object, "integer_array[%i]", 0);
179 set_integer(1, module_object, "integer_array[%i]", 1);
180 set_integer(2, module_object, "integer_array[%i]", 2);
181 set_integer(256, module_object, "integer_array[%i]", 256);
182
183 set_string("foo", module_object, "string_array[%i]", 0);
184 set_string("bar", module_object, "string_array[%i]", 1);
185 set_string("baz", module_object, "string_array[%i]", 2);
186
187 set_sized_string("foo\0bar", 7, module_object, "string_array[%i]", 3);
188
189 set_string("foo", module_object, "string_dict[%s]", "foo");
190 set_string("bar", module_object, "string_dict[\"bar\"]");
191
192 set_string("foo", module_object, "struct_dict[%s].s", "foo");
193 set_integer(1, module_object, "struct_dict[%s].i", "foo");
194
195 if (module_data_size > 0 && module_data != NULL)
196 {
197 set_sized_string(
198 (const char*) module_data,
199 module_data_size,
200 module_object,
201 "module_data");
202 }
203
204 return ERROR_SUCCESS;
205 }
206
207
module_unload(YR_OBJECT * module_object)208 int module_unload(YR_OBJECT* module_object)
209 {
210 // Fail if module_unload is called twice with the same module_object
211 if (module_object->data == (void*) 0xFABADA)
212 assert(false);
213
214 module_object->data = (void*) 0xFABADA;
215 return ERROR_SUCCESS;
216 }
217