From d404747de5ce622ac1907199ed48b4f9905f2bbc Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 1 Dec 2024 00:04:46 +0000
Subject: [PATCH] Tests: Add in vadyarascan tests

---
 test/test_volatility.py | 58 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 56 insertions(+), 2 deletions(-)

diff --git a/test/test_volatility.py b/test/test_volatility.py
index ea9ad8211..371dd281c 100644
--- a/test/test_volatility.py
+++ b/test/test_volatility.py
@@ -197,7 +197,7 @@ def test_windows_thrdscan(image, volatility, python):
     assert out.find(b"\t4\t8") != -1
     assert out.find(b"\t4\t12") != -1
     assert out.find(b"\t4\t16") != -1
-    #assert out.find(b"this raieses AssertionError") != -1
+    # assert out.find(b"this raieses AssertionError") != -1
     assert rc == 0
 
 
@@ -274,6 +274,59 @@ def test_windows_devicetree(image, volatility, python):
     assert rc == 0
 
 
+def test_windows_vadyarascan_yara_rule(image, volatility, python):
+    yara_rule_01 = r"""
+        rule fullvadyarascan
+        {
+            strings:
+                $s1 = "!This program cannot be run in DOS mode."
+                $s2 = "Qw))Pw"
+                $s3 = "W_wD)Pw"
+                $s4 = "1Xw+2Xw"
+                $s5 = "xd`wh``w"
+                $s6 = "0g`w0g`w8g`w8g`w@g`w@g`wHg`wHg`wPg`wPg`wXg`wXg`w`g`w`g`whg`whg`wpg`wpg`wxg`wxg`w"
+            condition:
+                all of them
+        }
+    """
+
+    # FIXME: When the minimum Python version includes 3.12, replace the following with:
+    # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ...
+    fd, filename = tempfile.mkstemp(suffix=".yar")
+    try:
+        with os.fdopen(fd, "w") as f:
+            f.write(yara_rule_01)
+
+        rc, out, _err = runvol_plugin(
+            "windows.vadyarascan.VadYaraScan",
+            image,
+            volatility,
+            python,
+            pluginargs=["--pid", "4012", "--yara-file", filename],
+        )
+    finally:
+        with contextlib.suppress(FileNotFoundError):
+            os.remove(filename)
+
+    out = out.lower()
+    assert out.count(b"\n") > 4
+    assert rc == 0
+
+
+def test_windows_vadyarascan(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "windows.vadyarascan.VadYaraScan",
+        image,
+        volatility,
+        python,
+        pluginargs=["--pid", "4012", "--yara-string", "MZ"],
+    )
+    out = out.lower()
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
 # LINUX
 
 
@@ -342,6 +395,7 @@ def test_linux_tty_check(image, volatility, python):
     assert out.count(b"\n") >= 5
     assert rc == 0
 
+
 def test_linux_sockstat(image, volatility, python):
     rc, out, err = runvol_plugin("linux.sockstat.Sockstat", image, volatility, python)
 
@@ -379,6 +433,7 @@ def test_linux_library_list(image, volatility, python):
     assert out.count(b"\n") >= 2677
     assert rc == 0
 
+
 def test_linux_vmayarascan_yara_rule(image, volatility, python):
     yara_rule_01 = r"""
         rule fullvmayarascan
@@ -415,7 +470,6 @@ def test_linux_vmayarascan_yara_rule(image, volatility, python):
     assert rc == 0
 
 
-
 # MAC