From c8571453e39913267e7042096d03bee040409b9a Mon Sep 17 00:00:00 2001 From: plusvic Date: Tue, 6 Sep 2016 22:09:47 +0200 Subject: [PATCH] Remove files used for testing purposes that were being detected by antivirus programs. Remove .exe extension from some other files. --- tests/data/cdak_1024x768.exe | Bin 4095 -> 0 bytes tests/data/old_ArmaFP.exe | Bin 20464 -> 0 bytes tests/data/{tiny.exe => tiny} | Bin .../{tiny-idata-51ff.exe => tiny-idata-51ff} | Bin .../{tiny-idata-5200.exe => tiny-idata-5200} | Bin tests/test-pe.c | 6 ++-- tests/test-rules.c | 29 ------------------ 7 files changed, 3 insertions(+), 32 deletions(-) delete mode 100644 tests/data/cdak_1024x768.exe delete mode 100644 tests/data/old_ArmaFP.exe rename tests/data/{tiny.exe => tiny} (100%) mode change 100755 => 100644 rename tests/data/{tiny-idata-51ff.exe => tiny-idata-51ff} (100%) rename tests/data/{tiny-idata-5200.exe => tiny-idata-5200} (100%) mode change 100755 => 100644 diff --git a/tests/data/cdak_1024x768.exe b/tests/data/cdak_1024x768.exe deleted file mode 100644 index 0ff731ac09b4e5e23b5a6f1e4eda692fcd5746ff..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4095 zcmV8@T4(?OLI5$qKh} zJOAy>4ubds0097C_*vcz0000006+i$009610ssJ!-`Vc3H24Js004jh0000007C`< z0096o|5v*L00018zJLKh0BQhP>45+M0002vm2M?<{U+V-bVk>V) z>)rtKW~&MYVU2bZd(y)I073=;009610ssI30001o4H@VF0000NaUw(D007{G)^eSe z{H@AMVSf`^Qt7S#|Njr8Eu{fK01?SW0lze?;Z2$oN|3!!ZK!Sk4V3451$fof800960 z4N*V=qhxB&yw8~$(QgEBeT;YC2P+tx~#c*m( z6~v5sWe3Tb-ZA|Tk@-^dF8Ez!hqc}tOklKg@Nm5dz5I|Xw!18?i2KJ1wgG%pS)nI2%6d-p}tsk(D2C*zVYKcn0?DVEm%1Z`B zp~kRoF903r&v%K&6cmF}sNehi)~n)c$`jkOEx zuFBd-Q`kIMkt`$yt}b+#a#xWgM4ch=PJG+zi-ZpqZ92_9%{nnCZb{(L8ovt5CzdVC z6a;Ex6g&3tAuI;x+W{nKds228?L0rHCSps^8Hsv|x_COrxpVMTgDC!-DA%Z;<$or< zw^p|;g%N-79TI<_%&Ws*@syyle&vZ((SgBoF>P3Ar-7tG4nK>D-^@!7U!yb|%n5>{ zY8lcD&%wxMBU-Sm7imG&3ixqIEIk5dN9kiN?jT!fe=!tZTj0jtfx|f|KHZv5Y3WcQ zPE{s{G)H|ZC^4sF7oc@*lg`H_h37mGr;$+D61u_5jZY$b>bp>GEdFQZiBZu6ZtsT$ z87BuWWGK|!^PKkr_b{G1ZI4o_f~(u+)mx3F4ehFG>8Mf`v>FWHv}&5;CCsgZ12)F) z2W0M9_8L9%e1>zD`e~%&>N$`j;brjrg=WW zG32b(T6=Zv6~CJFuT{+;qlTVAf-)9Y?YuB2jl|%f$sIQYbRlYccb)g#^h@tTEy&|U z0DO_LpyQ~_BpwGp%^vvHIVmYu!XdvlM=(-#yebe9ZeQg*aQDIk^0iztRF?&)en=&< z>J^n6$2;)_E()$yZx`dUi(g-Nt)E8B;*&=#q2kq1ER~{pguy3iy#L zxzucmwz35E$zLJX5wtY^qqZXiCW>a2mW&AyLIuIKa67)P68ly?RaBmp9JO6Hg#9!= zk7kvBrJflJb4U7yHV^RO?$i^D1zOBeUitZ!X8j|Its<@8Z3&|O(g3sG>WNyz*NWx- z=Q%o(pz9@G`v?(dz!{B-R)HX$o1R+$D}K%oZbo5oc30Alj1I@F&>bqM)vtEUhEow< z;-p6KLw8~D2g@}wYGJJo_XV9FDfm0_KNap&0vHyek*M~_+w=H}{NVcBEIH<3g}E)q z6L9V+$5&`0JGP&D^1+Y+F|GO$ety^+_bi`*zn2BO$Rohr)cs@2vCVFoGWivkT6$kI zZ$ksOk`A5G=+8OdWPhuNW_5J|_0woUWaMXGXz84f_Jq#v|GlX3qw@sx*L~BY#c2xO z92Vp+ye6`1D}{nP7vM)DMCM*hN$XXLTqJtt23-u^Bvf^}r=E+Lfe4_SJK*Fe`$OfV zmLtiC;681fA*flB#4Bb7C15BcWF4!$?Bz(fU-!p}9UKB^=aSyvgj?Lt>hu64XY^O24_w|XiQ0ldkVV!!xwiQ z(U#XLQGf68Jn>HdWP+>p!j;kzO924FfB+k9MBAFW?pKqzQrMglAwDV;1KXxv*TTSm zfF^0irf7VD8Q|0cuW5+ri5TZf7Q-ruV)^EwEf8eJ`=cxPK-mGJ6IMq}e3TN45>3a& z5p?`t5gyL>Hh-IqaS#%_g1tbZ8Ueh31;f62mKQcy>2~`Rjmvb)@S9{ld1F3ks-^E6cb7`0w77A;3;dCmnMZO4n4fdZ4hO zeO1Ah_c{OXx@Z8U0{Fc-eWLA=bo;D~kt*@WPlVUM&dK1%QsDW3-k{b6xt z9oKVAB|~Xm`TG2S{sjx0rf*!YYMMI6A$APCa(kIP0wRF+wR6hPLK=3}MaW{48$y+G zq7ztoF{+CZFTA!cLL>%z>GjVj39ZCb|#buYc za25Adjzk?_*jGgK9i#r%n@r~X0Y!D*)Eo0)rPYqRthI4$1ujn8J4?c)2;iQ2mHjW@ zeGA$rQew-PY9MJ*4H>ko=!1hJLcm=O<2;cjA`T;}l*i0|B5m2qlMnuTtK=Scq zJ!$7hXYOg=rfD0jdTY8UUMX_Ad7)?jx^r1F@Xa=Q1j*1)_|9h(Lni*ZU3UDNl;ocd z2_M7c9t%H%gIjZlb|j*q%@X9HD$n5m8nM;|{}b$#MF2~)|7jr0BDCXBi&4GuD3Z)T zne1922+S)DSqzzbKfvyos&U-&$^A<3ociXJ<&#}A>(+LzbU~e68$#D=@F3-BMpLBl5OJQm(%(b=2pOMW{U<5R854lwrWM~iCWB_{8K1&imzhJuT@eW8!rnG zSnHJ)>?1{efov6hd;0pa>I?=NtOo?J0q5kvSxnOUhveN&+M*z5Db5@DSqJaRTV$a+CeKN~I zNLGY=J_3GBRsJFw?s%XD4}j3&o98gYxG~xvG^SQ%dyH4;rU3S4Jy1|dp!d3s#9qpa zZ#?9y;v$+tWe~j zs8?@=BzSZizZ$dcI1BfL{KJ}Mtc*_|b#}i8nE1rGDIj{w6cvO2Hka0l!v9`!gX@~A za2M!>i?xz@UiVt1LEHQZok*xP6K5VfmsU|%s!bj@5c`4H%nM5`jT+&j1L!&8xS~_b zj7Y1iK@KStBgY=h`_FE!%Zvb5N})3%?GDD2XVE*=8>B+x708ZgxP)rN>}9y4&4%pF z$r{Y%J{?yCPD9-o7v&_2Q((>(?m9|l$X5w+g-k&U0MrnG{zg*| zT^=kgU5Xo}{|)Sr3!im^b+!yq@LvEnptmC^n=RC$X`iS<9|$Zh1nUO#?(sc$+MNm= zEl;Jfh#{MnQ0tXW|L9=LufO?b-a_{oU)_|gTb;=Yi|L_=N?~7SiC@pAF|)E7Og@4p zmCm-yAsCr_z;3lR95xA6m@M0l*Cv>^YIe8F_wva~U(;Qsa#dTho+bmZ%5M40-F+EV zq27$Ep$TBJjrm`pmEfMkuz|Flv#Zl1>m1~JjAZ2t^MKk~_}VW7m-}cXuba1cwj;JhJ!M`|Nwqx#RtL z|6Z-tv%2f+s;>UJdyX~dSTY(?A_}r1(oBqW!qU7!hGr_ z4uS*%2O@2&ZzOGQ;Gpl|E&u@7$N=#61pvL@7ydsRpa1~=y9sdoOTSg~Kmg#){#*W3 ze>wi80RZ+-_>b%Ncn|>ncWoK~lHmd1)rGx6K9aZdGEM-n_@I7M@ah5{IQ$y9Rd)LB zcQ-L(CwT{3LjfZr2V+Oa--JjZECnDyxV{?N#K14!sgFD|;14zSQqU_W|WxM-2+UlYe!QD;-pHxy`XA;YU zx}BfcA)QVl2i+k=nYv9XFPI){iZM9^qcyJfBn9^#L548(-SHiouF z<~F80#L7ydwCu!$j!ybEM*3E^HpV=}?#7P9e7p#--1?4=#?}T_?u2gvY#e!rogHjA z9SzNlt@Rygt<4P`Y#nV)oM;VgtvU4_t?67o5))eM+nAdeJ36WSbF_bkk}xv1aWZ#u zM}Q@K6B~W&xAA2D3Pq=CZewKY>PRQ!E@W$KC17Vq{AWMAxAXFLR%{&v91P9Oos12g zoE_dA-Pl?G)#0DBqholR;h%m^?sjk8T+MBm7>VhBr(tC5Xy{;W=k&$|?^}2)b3^^# zb;5tx3C)ZhjJfImVfoY1&e-NHcSHBL*6-BcLj7rR68INO{{sF1|6=ZcPWLzTTmG5W zpV9ub|KEfN*;-rM+RzHw+BiAbS~>n}dVhKSJ$u&QbN_qxf5HE+?ET%*+2D;4DPwmf zTTA1&t-{K}!D7J5{E?a2(9q1W|H;t5t$#4d zP5&2DZ(hLL(F6eq34d$oKaL;>K=HPP-wXi%TlsDML*6#}e-le7E07FlCAZ%o$?=E5^vcrYS10VTKCKnd1P9X4t@)DFm=@jtHDv zzyRN^V1ZjpNZ`Q=0{CeO3OreX0nb(daBm9(Tv;OmKWw0Z9UBbb)CL9kW`hTOv&9Ea zoZkaKT(N;Z6Cz;3o*G#5_yBCUPyxgCOu(o+1F-E*2Nc^015K{{K(nU=Q01inbi0TG z>EUj`Xn-6r93~EohN%G~3044-cq9NNlL%m_W&6Zc61m*ztLD_(P=x4w={4?MlT>yB+ z76BfyC4f&tDWFi;3}E=p02l!a0IL5cKo-3L@MX^d=pp+6R`foA9e)m>$6Nszi4OpF z(&d|e1Td4I05bmrfWGkO2Qn`fdQ$u@``K{1srIdT7bOVJRmi%97r#0 z1d<9`fyBBtAU{7JC@3fZ3QH=0l9Cdjva%A$D{Td8YHEOnh6bRuwH4^-=l~9CB7uPxz(D^1FgiL4OiWAwv$M0n{QNwyyu1u-Zf*htbNj&f(jl<3 zvjgny?E%Nf$H4jdIdFM-3EbY^{|4UnJe$juClKj|zv5{ZfSYP|UrLnd8Z@j+x zZ5i|Pi~jul5i1`);&1=h=%VVP*!+^eLe$qcHn!I1NB`xYRgumAo)`r}MdMBM^z{u* zO${|P42}N6Q(Y8r$jIJ<2#SkK{aeHZ{=(DTG05HoM_5eW#@^oHUt%fr7aqq&{2M1@ zzy_C;m9?<5v(?nJv-$)U{jd2kF>@09(c$+66Iu}l4HZ(94F@#hUpStsHOJpL83E4w zw`8#2lVKwNjqCi8z`y(aS^EoT`iSx7@*jfv*ZA=~f9A)`Xy)znx44S@m4CJu?{8;3 z56^(VQ6C?-f8&+8v}9z&+(E(rlt8V&{69A}m(mmSCZ)a|T+=s6Hq}s2(9bCQ3(wCl zsc&p=Z*OgXJ8f_BR;i6eMn?V%kNsNv8~(G$?{0sT#*)AA{Ko&XKkADj{>J~<5nqeG z7QKCc@3pr|QBmyQ_-`7E8XHUC|0Mivx5YyJ<@+y+|HS_!thTW+8vcLdC5??mfBQE^ z!~Jjkf5iXq{{I~Rzr`3db`7x{Lk2z008y>WqAeL_Wkdr+xHa!d|&;5*FQ=(*z4;h(yIVm3SLC7 z+A!qZofzA;_Co=9jj^)X@|=lGSoG6LzI%%)q(uI=$4?BWwrVtqn$r+MTp08IKkTu7 z5x_DJy^j(yQTlxMUYlLSy58are@opH@rHAlr|}@ik~dV)>wCQW<*x1gv*cCNRKY1# zS>b2{J1Au#$t_ZNy#Xr*k~bkWA^pa+YMp;Sb7=}Qr?7AkMw4qbS}?rGk%@RzZyCr3>d?Hej+-AAt8-=I z(F24w$ylMlL>C`_2};f=w_hNUCZS2>DF`qP&Ow%tH9;90D8Y%@YHmP`M#g@bDRlWr z5Ew0$H3h?DwU*IJLGtO_D%PX z)b`~k+7sn$!Kgb#8G^-WpP;&z81Vd4`dh@4GkU#1_{w%xC{hXiqy5*ZL2Sn)ZYxKz zPHINJh!>F(<7R!YBT7an%HZeqaUH zYaAVw6ZYXPKGK(a)h6@UrOh=G_PSH4Wvr}PiP$d*O#KYegj^+##6x4qYY&&BNB9z5 z-&aT9pIQwmRp`6@4s9$@G&eAEpD`mm!VGuPP5Vfn;8+0Ol!jb5bpBpNu!gcZmT*%B zG32@}`2ck^U&|cQSsV?`$)=%2Sk$-gu&2!^-9}pR+X6zEe;9}NW2Z}!y!m)(%sUVjQX=-+&IWZ>GiuXvWG|Bh(Wf*xBG6>{(P5QkxCU;aN=K(n#5ZfD$$6<@C{_D)MdQR zC!WYllrx(i)yNGPzQgW5+?(@V1f!6Q`PD4K5Gj*icpM0vQ-?;xpx~soMXTFO5wp@@ z5ncyJRTEeTZ+HTbI@a}ja#4}DzufltI?nFCluL1ssO7s#szS-me+8-PSJkd;cBC!B zG-7bK5}}BM4)sH*q^W@@t@CAj|2n@VWPaMU)A!XQ>JkjBcU%f2y^$fU7un|3g_D6g za!TbsBd>+&ys=H?PaRPqEBAMy;h;kpCXg0bn*v~3|D7VGXe?fUAQ z6WEUEzSE&hBdHGs^G~L1u~FYj?9UZHEuWPujcOdL79i{yp9)3VaupwlqAG6`@(nS6 zlKgo{65N73v*L$qpESw(&Q1+?RXj|7q$`Beooe8W5k8q(?^vKaIGPtY7=U+HCe4#K zQTFI&)e4eaSz62|51psMYPF7}ROEpO$^#ir#XdI_J5LKm?SoE8-iGYp>m;V7x!A`U z6xqsxC=1A$Xtsvb{&0BzdCXBti*GCe79C`-Rx6+Dputb#*TJe^23hj@FDusB;|W)f zP)^ZbPu_=Sy9kd0Dtqj5f_KFDI8^9dw}#Q6RCLY#ZIS(!w?yUOvkRa&ZsG2q+Q<*_ z(4z0}vRBQ|hOq3HLJItQIvHnp#+XF%$mf>L>vgK472v2sO(XMg3JCeGzbeZ#t?u)J zY``*%`**l7`OvPXRNAYqPGP89zQdb&=(^iJO%ihPKUh75UMv5xQba1-jHG<)aD(AI zgctkNx2u*fy z(2+etFnE_seG_ZeXT+n|66luvS1x{%$pOB`Zt`x_`YyB&+LM+jT_7_`A%eWnvROM) z%DPG%+OIb+^@N;JVYW`C-6Qw0!34Ug_9Uo1t?AJUAy0uRb=hz@yPrqKAFzV(?@v=I z>t$QXJjJf?Ciqb9i{|;d#n}{|UzFl0+yGRg|62C`c-L$KW{j=wz1}G# z!DJ5c_ag}O7ZW#HY0KgUTQ&=V8ltc`tj9x8x?mJDQ5gs^;>D!nmhj5#(Z2lJ8Cc1c zg`SZ8B$nLQaBXZO=3=j->nXTgN2zbdfJ8Z(%aN*d-jMbJGk=>gk#r`*l~ocKvSt6^{enqq(q=+n` zB+ocU2{P>=$-1AlZAD|DT|n%_iwgD2UQomJt!9LO?!z-pa%+*_8G+|$WUt0HYFxI- zQ!q{8V4o4;sdh3-Y(xwsA)gNNNi6?aS}^VHxx&fpm&O~6(8gg~33(AY$&{Gt?|zB9 zf_IA-`)VA{IQ}WpH_BBe6UIJgd@!3-XfQ*~S!1>F^=Fj0*`!0+De13$h}_jAj4&-_ zHb|?`e7nGbWQ%DjcLR4{4(BbNWTdp8DI|&;>|`>gdK*1n zy$M`#-#OZz@eCfbv3-~46rJe0MJs`eWxLA>J&*nz!xChP3Nn$GtglG>D1a1^k1nAY zTBwu!b!K^42H8&+yGrqi|K=U0Bsx(;Y0`*rQM`5RQ{27i#sT`O+V;w+P(7L8j?`xD z?8JI=N_9IOa!KG!iRg|d*N^7?AUFn7rr37HgbM^;W=bLWMDpe4)AI&q^^bS6JTt@P zF&t72FB???2$F>?(Nv)R?Jf6lahhn~DJ^kDngux^H4_`RleK9s?k9Vu34KP#Bc1tH z-Up2wL}YzrN2Qf{oxm7V&1o=jY*e^=sA!(IB>gDEf?+AD94zR-&;ipB_Ibhi+bY`} z`f*YFfbyL&*pH;s7Y@f?=YHwqbTm43=11iHHR6wjr)w|I8lKDQj7~raE8=8Cx={1hRlH+r0d*AG{*(-^$Xm!1j9x|9M+67#B z*Uq$`*eq}MMiDHR7%tOQ-dqCpeKXM(vve4!*DLD!3g@$5;h)rBEAk3e9! z*H0av%Gkf(<)*qwt_KU+MVy!Fu;Erj{!$xsjV02R!qg@7&|A9yd??)58p-uF*?WPI zJx8yod`^(dQ$M+#+mIC7we2b`Xk}@}J?e;Rg&g_UcO}u6`_)Xwk!am#u!5L^C9$m$ z+q9^}F+}VMRxtOq8+Fla6@|i2`Njf;tgH|H6-0TYScxJO45axz?K2vW{YGiW$c0D@ z8N)&S*}dmrILf_kvXQL5%7lAL*kSF@0@juTtu(W+krMa2zS?!bx;dY#N5WNf-##6?$JacS_^? z6Fv>&bDsv5oB=;IJP+oy&~TmEj;P5q!G(HTwiss=Wn9VwiUPG4k=`AVPqo;l8j4ay zsxoNXb8D9b{2m=MydP!9d(%0drq&Kszr@%eqw<7r?%!mZrGvU7C$&o35kzH_Jfn^t zeoS>8Ijp&H-8Ex6A(7nd>Zr1gK*S0zm!c$0a-mXH4R#!rU9XlhJ<1` zqQ`0T9O$}rzkNp0`U;^Rcdd$H1of0VUa=(w={LSuMvd~Vt1-Dssy6>;=_L3I9^ApB zDvyQTmc|@fBs%zktZ^j<*W|sF2)V=RUAZc(iEyGD(O!G=;Py_77v1UR`R%SK#zkE% zEgMWgFQ(9Z57)401~vR3yO&_yNkk_NkwskKgX*a5$!MHCOM&>(``~N{mqyrxvCX8g z%MZwLAGF~b>evTLNYI0wAy*?lvdl&r$#79k?uH?uxIGw%t`}IUE4^dfxC+2no8f;@ zF9JJ}BKyk!VykXy>IfJ@&2ngdPui*RMK^=c+n=MT@i`dIVLVRmv5kb7wp^2m793m2 z%gl(QZ5rbK0g=l53nzszyrF@5ZDz+(W70L)JVSFZOo!xw*8prcBrzh+HkH?H;Q{cr6>jxa{-bQK=Il1NY9-6|L3?DqcG!HZGn!w6dqUe3}q;o8D zV`XA}FK!tHOeZdi*t-I%5l2nuIzx}1TbN+&HR8OC`h(48Ml$Zjn+fmO5o21#fxDF5 z4f^f~{=E0rx-dhQCYh84mK%j=cc17bP*^#qur<;*wTb*T9aXK{$$Y^QgwspX=r@T! zfQkNcDRxfzX2~WxB4JNVAEZS?Z~6fj4rOWvas4Jr2J>~K1x1l9`$$miS~*tZrx;mo zfi+dz_i~6|Am0%Wew2oN56%w|ZRRofnR=o^dJ&;TvUsX6K;JM<+U>9zF@cIVko z2w9ozG77sTV-!yAO(vDMn+UbJr;x$ux^ijZ{R7zgGT!*1O}<;3f1txcW9&-{-m^3M3GdVNbP-g&Q%(eWjFZ9M+P0Wu$I(mA5)v9fQQK`~z=NiA@?VSFj{0WYQJy)1X|wH_mg=PZhysf)tMjs z)i}l7;6w~vWj`>rH_68Nner*e;_E+q)n&vYi1>9zXClGS#vGnR@(IllikXXv^DxPDjo@x#|f}!A=Cl^)GH~mXK zR~D2B5k$%NUM;($v+fn<1~;DOpQEJjH}iOZ3~pmP#<)#0KC(4EpgXZq!h$}h`0C1} z3L2FSH_a3U*=f&FL*A4)P!%ALnJti*XG13P%v)}Knimn&gCydhP<(lkwg5E+oi4dr zLt2IMz|GK@8sr?VG3JMR<=8olaO0kWF>@gQ5EaviPtUvO^_081)`<@??*V#+qRzzD zw5;ZO(cm0c8j$X9c7Cy7OBrAkiB&b_jTiEXg-c9pq*ttTHpa(Y@--*SML;RA z;3?kv%rL8fl@%4laP?g^(PH8l$&zJudHqeU;v}}SHioT^qx$HzB*@;~Aik>lrnkd4 zhUoakQ~(OiB7U~!dvtt1B?B?XavEOL*$&wLVog{HdPq`;nE-!En-!Tfny3+>&e!W6 zlmRHzMSB?M-DGHrSXy#yJGP>bBri+v<9=^hXhn~8b?^8c0d{#dU5ZB!4axSa19oY> zvD9}Xe5dpAp6vQ4h`a>WFc@SM+*|~fBVl9~qpEU2S>3gTWy?+HO`^+khMjG9lipa7 zHIjXkb?DNctVp~0=?H2#`zoMCRP7eqV#GfwEjZ^(|COPHe5>MSrtr}D^u^^s}Q z$lqX_4&3?sxXfwAhaa*oP|>ZZSZ-W3`$%c@EpF3Dqr#{6(WV8f9i+nb8q5@rbpAbUD(*XfDa}i zSS?=0(8(af!E@i=EG2>|+t#bRYq4){4|3ndVP(`z+oGS)U$Ne(9*~@EAr=%{HrJY3 z=aEooE}wPW7n`U_oC}Qpq+d^iy(J+nCE~ z4zU-kkzT;7Ym26ZE&Zr0DP~vF7U0pcz*U)bgYZL&=|oifd2iEm5$}Z$C|Y)G5x_7Qrgk zxP(8)DH+jFN;2{0_c-<)TT}GVGw_dIk7la8i%>`Lv4ylJuW;WtPpw4;QIHm=8??nw zYRPq5;+%_X$Rh=7PIWO5uq~e**Bjo507+%f>_xayoui~kbq5_r)=a&HvW#&_?%*w; zqzax$zHemr(CT|)QxR~EPN0p4NNnUM?%lCKt^u-?kTPmO;D$=LRxm0{!u`i^yK&q$5+$E6D(>W(9l>~vV| z%N4u~d@qX-W2wv+1DOd7O2|}SlD4`Hn{~JVD8tX_bc=EPT`1w_x;Q8E?3bdG5D;_x z55;P6cmlgWS3MuAb9sY#5>cG>zRlmP(_3CLx>!z53xLzK>-R)x;X%f+#D9&eTDS%C zW@@=Rv?{V&wxlSL?4lB!x0bHgdh#pLOJ*9@O|&Q6caKugKu3MOB*0%LfiHTGGXR;X z4BgJZg6v%=Mh1J2i#rrV!oj3>I}Pr%Xtv|Z(^V}55gR-&E&()o1}5xcxfL{rPmVb? ze2$1l<7$J!SNeD?=?5a?d{1$SVz8aQPXm6$C#+&dHd=rWizDO0;g2MT=%dRS@DFg z$^+TwrdVZ(l3$89^e#%#x3hKYOT7j0iTw=#A`1k*NC4Jw`)J0bHcB}${@J< z-@J2M`_ge<7e0*kb=XGLpc^rS8^?T7zS6iM{z+$bP0aAk&olU$ZKL(5m*FP zflpgEt|8Ojs5DK|O{E>n9wV-0!|fi-aP9YqbVq0k(UR6`(sZ~7G1J2X@>aw4DAN1E zBRN+uUU#OCla2g_Pv7lj(uW-G=vG}$zOx-kp!nIE+}f4lv7~xvnU@7B7LbPs>)|Z~ zkhVXsnkY0wWu9e$srd78BRdT?aEilGM*8yIOhzsII-@N3IHc_Weif1Vf#!&t+24dK zU>!@Wq9TX(41E0>29LZ8x@4=lLT}8hvi5q?3$-``r**)`A#*Br`7tnEV+=r~M;_Xr zeuzhmq4=s3X7>S%tx};t!pC`0<5GvY03`hDmZss`UkK~^(_4%hNUXRc(wNlqNO3Q^@+j!JCOWQ}!Y1$Ib38@2ajOwih8~a#39CJ=`@W%_Dc8*)v@QrMQ%-@{|5yfxGt15Wz)9UsO=4 z>J^aJBxjsVnrk1Fb_-`{*f+s2Usk7g_@OD3K^HkhAXNb3&U$w-9ILrv%xyxg40Fox z($Fq#p02G|xntqmulJ@3oEqImIG@`-w&66i6Lp3nen++GqNr&r5W1WQ^))X$ae)Ar zh9lqg>yvN@T!xb=DjpT_OX#i;h}(@CEy_ki8G4yzt>7NY75W?$j@8 z($Rt6GgRRmj%)Dg0bYcdZY`z;eTfhv%xm z^b;7CpGx?iG#y71$DlT^cACyf{)&CJ6aMndxT>Bx){0{w9a)*xKU(J`2eZYZiKPZ| z7P>*`tz(2{EFPvy&qE9NnAgCfRp@eHeI!w5;9fH-#_uNxhSnQzdb^CaHJ1W}9y>ki4*&6RoXIxCO6X{OiAyV)UkOeXc?|Ap6kLgP?j_+M2u2{a7)rHr zy^(LkKw@rb!30@4b4fF;b(Fpyu~#U8qtozsqq|F$%Acd9BW3$DZry@U+siD8zE&?& zo+CqguXFkn_UQs_CwV2-0COquye9%PC~Ft&XA9j3&HU}doTrYBcDeoC@*QOB zG#5;j{ugQVRptbt~%ChLt;si$V9fC?x6*b$_pJw2^}Bc;-nOkfd=&#q0`5K<5*!lBHWgUQIsr0(RTe!NuIij<+{58$^hUa|*C z@ktlwC=l)ncAt7T+B#ht#|rW=HwnEKJG){Ps1gwf!9A@eLp2NCrG^GW4zm6d;+J&)W4Z-9NOSA`cz-UURCutSAvw zxuw1%nrwju<>jmT4wb$xC+~Y!iG<~3QxSK_@r=CBvZ4u}YVMGM4FO92fxy6og9+8j z7MqvyXtdvIYA}m*J0f6DNv*;;M5Fa5YOa@ahzUKBxf%{!>zDmsQ8svtmqm+{a%KDn zo7S=wl*>;O;yfm8aI#c|61-qpVp2Vqp_UFeF^A-;*kO(xVrhPGYO{|sUt)yjB=ulq zB`h?r1FZ5NIdwR>VX}h3x9SfA89y#~*^`y1ehoN`=yIgKrx@{joCf(ew}^4S`BA*( z?E$I7$6e6+EL$G|zbpNm*Db9nAKw79g;|`S8v+%VpDR{Tow%ZVfY3a1=eluK8MDmQ z9tI*;Bd>CAxJ_rb5x+P4wGJcd3eAt<3S>WMw z4!%|FPLqyk9(zyI6*As1KE>E`#q5^$1w_u#t4te>OHh_Ej*b^+#7{;LfnST;lt^EA zNcTC>tbTr0a4l+cUYMu;rRl>&K4wmDnpVy<|Izhbw5DB8^(WuTkg9hpp^r1}-o6@N zN>b}0gt)+E*7ta48KMx~UShEFKgssM88XPFK{!l^KLp>7k)9jLv$%-f#wz=LyuJ&x z_~r`^Vi{stp-?EEA5aEY9*;;Yy^S5bffrm*p9b`>6gEBQ+~0UKUs1}Eu^Er9psn>< z?!n0>zL!C1J%*-`Q;c~M+xI@g36)2RQ|v(dg;bRJOl z?RixsMuy=1R>EWu0ls^w@O}*9Rjz86PeF&CpLF&&^zRg~l6GWGqf$2ItL9YKgg0vb zkKB#|YCrd>Hf&Qy1q6B`NLY$C-=nLuBh>j7{Z#%6%JX0^QY96^jaBpX!g-C>vIJ(= z7}}?IXSU&V%)n#T%|PtV)~(4tiVgm9c}KLRyt0|S-04XX2EOl>2f6 zH7Hjd0r&8wulYHkBEDBOeGFLXIPJ~io zJgZd78q|^;cXt3%+XgSop_T+rW=MO4(IF`ysXo+HJudM?47TS!c7u~nYo@!4(*mB0 z_bxq#fl0}TpodHsrVz9I^H)#-5|y{dhfkR)Sv^w_7p&J7wfn>fkBKQ19(+=SE;Gir zHxXR#BNfH$oJTsI;aV(k?gc!lWspwLDt%U`MgxpFnPN^l92(JbVK(KL)|l;QVA|9u zZstFbpt855gY`8W89X=hX_Y?l*oo9Weu(6w*w{sySZ-;|{TPzR=FL-J5>nsa@R~eo zr=io;9mVzb56Y#?L%2gnKuy@gYNr zI@O6V4g-ArPeM7TMCHA96-gOH;HsX`^^&$VSbKdG)9-auo}el^c{+O`hpV^h3>Cxk zr_*g_3?U#5h+-gMRV~m`2!L`Q0LSsDz`})QHqkrty z?Ey3`o36tP)vhmU2vIl;>TuTwLhbm%kW5=-Em=gUUX*c9{jL0zvdMbu~fn@lD22xt=t~C$Ldg3Z`frHKy>w&SiyRpO& zAywmvGNWPo(9|Gi&7)lBBk9!9f$iwec4n8)L-zC}oS$@zz}G&{&bw^(@byopuunyB z9fiU5FewMRQMyuiiHL>L`Lr{?=&1&3ls0u4-hit{X-qzes)i0NUmWT?pRCR-v zs#9z%?2qP(O% zoPPC(lsW{$&Nkynbk})pB&<&{X?WfXG-@60b9 z19YfcwMqvH3Tg_6W~ZZWJ^P*=q+P)hr5E$q4kBRpb12Knm%|TE9;^6lnj({whsjJt zwffwZt?YsfNBz4bks>(YY(EZF4D0ioqXcIMF>DP139HCz;9F}e+`bo@{m5t zF4$+ySU#RYdKRK(HBV}|q{1h}Rdpb#vq0pPi#QcKaV*Yd3*-)J65o+((ajU7yw;(FCm)|~4JTQHumS^%hTE^O-4H^7 zxMT4`;vFJI7aZANHB`>g*F^}8)|7dfM-azHf0col9#$8#&U#;Lc+P5?5NRGGX;ILR z+&p;w@p#3!ZJBYh-p=<{w2cRGf|065I3!t5_i&|aKy`WM!~Dx5MQ~7&kiaDCR|XGnv=!hy7~}@76Z%k+j`&22VSTq zS>y6TaV-2yMHD>+zEdWas@<}62;n0Z@isk;@MTaya z_R5A`Ue=Ff!Xra9&uc5WC^fp5?UY|;5X2G=67g{vW~bV(w&i`w`O-hq8}hG-SS9gEdr^DHQ`wnEogWtqT9nY=gZO;L+R%7$KKKq{%nlsb zhLvpz=|&8JATOUr5jC>v!cM6_HJs;$D&V1RCd>8vGORyLXLV}?+LDaU>S;!+74sR6 zX;Cs(;h7H^z6-v!`hdF_MtDTFyn6YmLu0N@TYsKZ2zIU$HUUGSU08jE_c4$P3fvB+ zVO@2cVd*PZ_GJ9o*~e+6Ig3Vm81(0KqRN9*^V**FWlAq3yB})5z6Nv&+I*8J%X^$= zeM*V=Rmjm$K1Exia5oO2WR9-&!h~(nQl}Rb&c4M~mMxaG0(-VPrR!#%e_N=)$}NnK z5kEW{Fyt~cQKXax=Wr%Ud&Ry-zSZ)fv>xG=pYtZr6VXzP5ecskjTo@C_^<@k?P;M6 z?xg~=2nSBJaFt_KnggyICcFe)y5jN4*ag6_LyLm5?qcT~t5VbHHs*cJ*GElysk^Hz zQrsSL=mHj`emRC&bOp%4Y4WhrLb|kfv!#EO-O4Yp?-i(;LaS<>sfBJTUUFk+CZu6r zCt&bUV#26{U^zDmB>Y0Q8MRJFU0f=-JnZ%+WVy)^m)go^53#^OCVjuQe6nJ|;lWQkTk&SWi zMPG#^kuO#X*j_V5$5Nr$l%4uMp=^;DghYP{U6Emuds3;oMA3Vz zN>M{&KOJ<~E9YfNn3xv#UMR9XE|G=zUcr-Ba{tr&XCpcw zz+!1yN7PhK0-nf2;Ag>cUJ`YWXL7iPT5Yh)m+0^;Qyf1ai|z~eCo#eG!$fJuQ2b@D za)^%A4p+Hv(YZ(i0gR+gFt`$2pzsiC>W9^8;_|JJKkS2XT(Juri#IRAMnIZ$?}h@N zzC^PiZPRj%0~=(O&~RylVxf8E(odoLq6aqR#<=KH_FTH&qqFJEZ5!W&@0{f)7^SVQ z=VtQ?c~IQpadEdAFEc(elxkuj6%C=6i|+APBgI!a_(yKtj5DS-P>V~pe`_0#)W~+e z?G2l6_hQH>pzJlX?CQ-z2xLO(Y)08h9)W!@&q(On3-!OS!D9yC}T@G(U8Y+KawLNx z4xi^T!BWt(Q!O@$T;~XB;;ecZ*GF~GP4tUMpNgbRU1d#ZStFVrLl03u6AOTHoVo-V zzw&5zKSF0RT7rPX>{cd>$E-uSa6`&rqeXIkuj9*qfhUH2z=*&GaOGL-?%_H84!tkcG%EU_DT6OoNek2a3VQsUOVuouZ1-FOW{tX>Xu;Iyr@O z5Fj>X6>hw*DJ)B~LJInov7txkL*Qg=TL-qi;dHIFrr6MRk-t5>;_8T!&6FhaSG6B? zrp?+&zsFt-cmyH7I1pN2s{o>)ZPc^|q~Ef+(k`DCKK+oy2Ndgp&jK?)xjl*?tc$ zmpL=Joc-d)!f4{9C5h|gvD=aN$9;-&3j)I5L72MpmFRTA_XO|Y6EVV_xAOR$#<4*1 zjrxFX3Jr|^-t4EwCkSZsu`4ESkepb)twOs;j~=s2%wJoM(z|}D@Zl9cbMY=|#f_hE zav_O-Vc&2I_Hw#=oc$gGN|Xh;MvNRM8H7G^ zyiW#J$EaMlO+luIzsVSe;)rMvSWZ?JGiqTO32T?7&E(fLeEzPqt!wwP4!1HXg`8+> zfs6c^x}%ko+f>0ZBCa)pdDSH^e-d^w6KOTo3Q1 z5IF6T!)P)D*fgP7a~gl{usbS+b6ms7H`x}KiR6%|`cK8z$Pok`nU6~FB!PRP@i-S7 zqxw^Oro2;wuTl$NWDlai=5tL)U|6}Cql_rtt@TtuFddDeoqI$P>OT=7wfmVzsQ7Yn z?@`y|(SW37mNQgx6hLxcTqbkJ{&_=_UD$pYm3r`Fv|%FgHu)XVeCuwbzk%V@w>YGh z)-zJVjXnU1CgQyy2FF*rVU02goDQ)mjJRW#U$=Fa$r=V zx#hPJPX$5#n1BFfi~i}zA+S%reB(vh@yj8Wx&lr7M@9z3L|cS3cpjS!)~~SaEWRB& zk{ot0Bn)#^jo6ZXCAr!z+n@sbR7DvNCaC6SW(kiZ6ocJFq~Oop8QU2p7tKaTE_at; zoSfIIP2*B91nwxXyx1{*HO3)}ZV!s(74TDe0TIbd=7Xzb{^e?w4fFca%T{v-ck<&v&SH3gj%| zXypT#$`=upiSdG0jmr}KMwY0;0nqpG))EuDwpXVKqnyvStFtl6?h1A?ubrk^Nwh)A zdjJ8S_~%;cW{pPv!$Pp2oA92>sydR@xrmMoHnYImf+cv#py$t@{a~on3zN2F^JZ!4 z*VLin4!{kTAw^7%NF=kYC@3XGwg;BQ?haO(U1@(1fW}N3tX_FPR+w@x@1|BgT03SB zzyB8e5u;?S6{0{hYb5LTzK-8XxbWwe+jIE~>gk=+vJp-}vqFUQiE#I9w#W`??HaKKj;Q-lG>3>U*$)lfki|oyRQnC- zp|){2`!4N8pjrmTViUgYw@b2ymVEUb@#0$x@oF7epW#E~*3mZyct#|0SopTUc+8&_sTTVpybQdfcX+ zS#@V$8$ZT_?525(cMW3mIT3luus`$E&L6ENOXLO@g8$mA6ww6nSfc^iiZ0RuZ1ZRT5sF0g7=Jn1p&|JmhyDu^W*Odub;v>?9Td9^C6uUckNaYci&F>@4 z6&J;JKDk&%zfZb6)m{!0m^ZY7l9LVmW$=JRx8*#4nJ{xG)Mh~P_KxfwM$@MIF4@9B zSl^Q2V^}X|uy^#zhi`-f=hzVH6b4<2bH39pEkO zQ&ZBwPs(NFczeMF0zSy}qlT@Lp1@P;NmTQzkX7(|;?#GxCY0t7GT7&Y9ld^)-5{V5 zmAmCtgL%KaY@Epw^uq@4NOXlPaitVja+gbs-XVQRLCuM?uQ7n$_SEmof zVKfbiOP~Ws*7l6{$h!rJKh9OsmbZR~^1JWVMgM6vW?t}Vmqqw2Rc27TDGz*$3~C## zuXr77Bol&X-M**1C9@)t&K=8!)Mn>TXOYG1wo%((OY)0Y?Hv5g1ib#dy$&b`BxZzg zG3cN}*^y4u=S(Vkj}_R~7Ns|^UuVB3BY-&^|33lz2m|-hUPEQ+D9}Mbmo5b0URC}g z+Pf+L1Tu{cLqMAI5cci(d%evJD~Qms&oDqsp=7=a+-F9OU&3ahELUp5O58`2?4wn+ z6`?|^bxf;4iH|lp;PJnodr#mf-rr1iVgV!9J4+au=0rgsU~>H)+^j#NLS^h_iWr$$d}_!zJiUzvWabG%q^?pFebk z7p9VoM#xu@2W-n0~CuK z&wU3cWBd8Cbm{hiC+R6H>(4OZ+t;=;$KGq>KVPo7V>UE&tBfn$klC(_DV%}b8&JR3 zUdBD2J!8&?aD#>Y>wrQ>X9B^0Nx2l#APO!Mfi*+SzPR9eu&N)kHp0Mt{ z&EeoqsnGrn)MPx(@7E2xukB4e+d%7bdB`?b>+9y|CvL07KDT_^fs;7#Hw>PPY0(J4 zq-g3O|79E_+bW}(^z(bSbj0)g<9OBgus??-wLQ44t0ms;&lOHGG@8J#4kaNtN}A4s z-X~qeqBY{E`^+WJy!&5Aj|R6#_9|;SwxZQVc%~RlwiX>t1 z_y7m~S%cd53l{jNW#FbT>_p+@%noVEr5_oAnqi?;mbC4*<5t{^Z_&u8hf5SOEm{r7 zpY2sXT-t4vFiW=p=3kq`sV_4XIcA-hpLj#I(*Cq2?FOf-e?nR={W)eTTw`)0v+toy z7a#dF-t`!s;OlVAFPqXBnEMy5QEW*CSaYae$S4u=vWwF*1i+%hVeAy^NTy$Mi}nhS zAkv)Z77knzibt5e60ebphFd^a3p%!n5+w4_9J}JVxnaHyBbuos4i8d z^N7R}q%!tEapS&{aG*^v~=ypRh(6YQ<=JgeI(&r?? zmEVfASc#MpDZ3c!coiMQ$8rMsYPXk`O3dqoW;W@1l z%+*KW-2EF6W9V^nEUxg1Ta_(ueE|NWbol8SpR&?U8Yghaw%QDh?XL3#6@M5Li9J)2AEJtZx6Ri7c}jkI3A-nJ!{9RvRLWa1XO=(3Tu zW5fva+}1B^xb0;d1MQo9hOfjVgDpB;uGjked?QMY{UpmxtP(h7iH>;fPX3P5gyNGK zcHz>e0Ais^UP|SxCcS9;>-;Z!#pQ1O;=IDch5$iSCZ`Y3v&n1uO3geVpUpQd@$QF5 z2f9*E?lU*3^~#+=L8!6qvO2$YnZJpfX>`qlp)*V*m3T{gy&-|2)n<96pVq7}50t=5 z34&oIw9*4z-U(e_t6JZH@j)drP5TBEh%VSem|J*81vMUZ6Ogebz^Ucbp>7tJnOas7zgE zW_xlGP2(^D^}81t*55B%X+!N81LnPPWun4t$rsbaxM>48BBq*cd?8+(T)Smw&$aiT zqjtdKVoRVcRGDze53vunWBS})V3M_1tr!?tbe3bjr-6m?J=hjLviG+V-vw zQkzDi;uSppmvOG=_=T5{CjpMnW<7U_fe`#cMso(I-ieM`y)$Gt z&4*}RX+5;jnL!=GDT}32 z%pAWng0Mz@bI6}dug9q(t$}z`m(=QrN`kFN-npPB96coPkW49xF~~Rg3{*eev@D`+ z9V+k|#VWT*Bv$bY2p9rwSLA|zVsg)+@Ij%@KODAC74TC`eK^r^T??4J;cK%SY^t3; zv#BtgB~n7tvdHx>X>&H0wZN$x)t`yvp?!xrC|2I_xEs8}wIGx8+e2WD-Hv_$(=!Fk z;q(I>3VVnE0000pz(9>ug#iB+6Tmyca`Y>~!?6he7L8H_umN)m{}!+ba|OZS1+WoN zjVyxyR!m(3#lujG15&~03-=<6Q~Zk(56UZ31Utf7b`OaIGr+V6D+0mj1pxx<4FN+0 zDFcfF!RQ4k0{K{+fO`V~bqfDO{J~=c2*D!=ox@m-RD)Rm7IIGn{Tk9D!aN6a_D~PD zZ~wvV1!igO00WJzs|XMP09UX9;~y(~2!sz0mBjwUjZ}pI{}vL!(CKszD&TsSixWTrQw0Aw0$Q&C diff --git a/tests/data/tiny.exe b/tests/data/tiny old mode 100755 new mode 100644 similarity index 100% rename from tests/data/tiny.exe rename to tests/data/tiny diff --git a/tests/data/tiny-idata-51ff.exe b/tests/data/tiny-idata-51ff similarity index 100% rename from tests/data/tiny-idata-51ff.exe rename to tests/data/tiny-idata-51ff diff --git a/tests/data/tiny-idata-5200.exe b/tests/data/tiny-idata-5200 old mode 100755 new mode 100644 similarity index 100% rename from tests/data/tiny-idata-5200.exe rename to tests/data/tiny-idata-5200 diff --git a/tests/test-pe.c b/tests/test-pe.c index 6b2b60b92e..c2c6270cc7 100644 --- a/tests/test-pe.c +++ b/tests/test-pe.c @@ -6,13 +6,13 @@ int main(int argc, char** argv) yr_initialize(); assert_true_rule_file("import \"pe\" rule test { condition: pe.imports(\"KERNEL32.dll\", \"DeleteCriticalSection\") }", - "tests/data/tiny.exe"); + "tests/data/tiny"); assert_true_rule_file("import \"pe\" rule test { condition: pe.imports(\"KERNEL32.dll\", \"DeleteCriticalSection\") }", - "tests/data/tiny-idata-51ff.exe"); + "tests/data/tiny-idata-51ff"); assert_false_rule_file("import \"pe\" rule test { condition: pe.imports(\"KERNEL32.dll\", \"DeleteCriticalSection\") }", - "tests/data/tiny-idata-5200.exe"); + "tests/data/tiny-idata-5200"); yr_finalize(); return 0; diff --git a/tests/test-rules.c b/tests/test-rules.c index b59602966d..8aa3058681 100644 --- a/tests/test-rules.c +++ b/tests/test-rules.c @@ -1034,35 +1034,6 @@ static void test_entrypoint() assert_false_rule( "rule test { condition: entrypoint >= 0 }", NULL); - - /* https://github.com/VirusTotal/yara/issues/373 */ - assert_true_rule_file( - "import \"pe\" \ - rule test { \ - condition: pe.entry_point == 0x18 }", - "tests/data/old_ArmaFP.exe"); - - assert_true_rule_file( - "import \"pe\" \ - rule test { \ - strings: $right = { BE B0 11 40 00 } \ - condition: $right at pe.entry_point }", - "tests/data/old_ArmaFP.exe"); - /* $wrong = { 0B 01 4C 6F 61 64 4C } */ - - /* https://github.com/VirusTotal/yara/issues/399 */ - assert_true_rule_file( - "import \"pe\" \ - rule test { \ - condition: pe.entry_point == 2 }", - "tests/data/cdak_1024x768.exe"); - - assert_true_rule_file( - "import \"pe\" \ - rule test { \ - strings: $a0 = { 68 00 00 42 00 31 C0 40 EB 58 } \ - condition: $a0 at pe.entry_point }", - "tests/data/cdak_1024x768.exe"); }