Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add a btest for the PE analyzer.

Browse source
This commit is contained in:
Vlad Grigorescu 2015-04-19 20:27:24 -04:00
parent 93b84463f5
commit 0199ac5ece
2 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/Baseline/scripts.base.files.pe.basic/pe.log Normal file
View file

@ -0,0 +1,13 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path pe
#open 2015-04-20-00-26-40
#fields ts id machine compile_ts os subsystem is_exe is_64bit uses_aslr uses_dep uses_code_integrity uses_seh has_import_table has_export_table has_cert_table has_debug_data section_names
#types time string string time string string bool bool bool bool bool bool bool bool bool bool vector[string]
1429466342.201366 Fz2N9x4SAxQiSnI6mk unknown-475 0.000000 - - F T F F F T - - - - -
1429466342.278998 F5fc4q3zhJHmYSvm8a I386 1402852568.000000 Windows NT 4.0 WINDOWS_GUI T F F F F T T T F F .text,.Ddata,.data,.rsrc
1429466342.225653 Fzysjj1zfjAcgWgm22 I386 1171692517.000000 Windows XP 64-Bit Edition WINDOWS_GUI T F F F F T T F F T .text,.data,.rsrc
1429466342.250474 FOuWFKf04xcHH4ck I386 1210911433.000000 Windows NT 4.0 WINDOWS_CUI T F F F F T T F T T .text,.rdata,.data,.rsrc
#close 2015-04-20-00-26-41

5
testing/btest/scripts/base/files/pe/basic.test Normal file
View file

@ -0,0 +1,5 @@
# This tests the PE analyzer against a PCAP of 4 PE files being downloaded via FTP.
# The files are a mix of DLL/EXEs, signed/unsigned, and 32/64-bit files.
# @TEST-EXEC: bro -r $TRACES/pe/pe.trace %INPUT
# @TEST-EXEC: btest-diff pe.log