diff --git a/test/test_volatility.py b/test/test_volatility.py index 97098d1ca..f7cb23e93 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -315,7 +315,7 @@ def test_windows_vadyarascan_yara_rule(image, volatility, python): assert rc == 0 -def test_windows_vadyarascan(image, volatility, python): +def test_windows_vadyarascan_yara_string(image, volatility, python): rc, out, _err = runvol_plugin( "windows.vadyarascan.VadYaraScan", image, @@ -476,6 +476,7 @@ def test_linux_capabilities(image, volatility, python): python, globalargs=["-vvv"], ) + if rc != 0 and err.count(b"Unsupported kernel capabilities implementation") > 0: # The linux-sample-1.bin kernel implementation isn't supported. # However, we can still check that the plugin requirements are met. @@ -521,13 +522,14 @@ def test_linux_kthreads(image, volatility, python): python, globalargs=["-vvv"], ) - out = out.lower() if rc != 0 and err.count(b"Unsupported kthread implementation") > 0: # The linux-sample-1.bin kernel implementation isn't supported. # However, we can still check that the plugin requirements are met. return None + out = out.lower() + assert out.count(b"\n") > 10 assert rc == 0 @@ -580,20 +582,6 @@ def test_linux_vmaregexscan(image, volatility, python): assert rc == 0 -def test_linux_vmayarascan(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.vmayarascan.VmaYaraScan", - image, - volatility, - python, - pluginargs=["--pid", "1", "--yara-string", "ELF"], - ) - out = out.lower() - - assert out.count(b"\n") > 10 - assert rc == 0 - - def test_linux_vmayarascan_yara_rule(image, volatility, python): yara_rule_01 = r""" rule fullvmayarascan @@ -630,6 +618,20 @@ def test_linux_vmayarascan_yara_rule(image, volatility, python): assert rc == 0 +def test_linux_vmayarascan_yara_string(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.vmayarascan.VmaYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "1", "--yara-string", "ELF"], + ) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + # MAC