use matchkit::Match;
use rulefire::vm::bytecode::{Instruction, Opcode, Program};
use rulefire::FileContext;
use crate::support::run_evaluate_index_with_ctx;
fn result(program: Program, file_bytes: &[u8], matches: &[Match], file_ctx: FileContext) -> bool {
let got = run_evaluate_index_with_ctx(program, file_bytes, matches, file_ctx);
assert_eq!(got.len(), 1);
got[0]
}
fn default_ctx(size: usize, is_pe: u32, is_dll: u32, bits: u32) -> FileContext {
FileContext {
file_size: size as u32,
entropy_bucket: bits,
is_pe,
is_dll,
is_64bit: bits % 2,
has_signature: bits % 2,
num_sections: bits,
num_imports: bits,
entry_point_rva: bits,
magic_u32: 0x11223344,
..Default::default()
}
}
fn match_alpha(count: usize, start: u32) -> Vec<Match> {
(0..count)
.map(|idx| Match {
pattern_id: 0,
start: start + idx as u32,
end: start + idx as u32 + 1,
padding: 0,
})
.collect()
}
fn match_pair(count_a: usize, start_a: u32, count_b: usize, start_b: u32) -> Vec<Match> {
let mut out = match_alpha(count_a, start_a);
out.extend((0..count_b).map(|idx| Match {
pattern_id: 1,
start: start_b + idx as u32,
end: start_b + idx as u32 + 1,
padding: 0,
}));
out
}
macro_rules! cpu_case {
($name:ident, $program:expr, $matches:expr, $input:expr, $ctx:expr, $expect:expr) => {
#[test]
fn $name() {
assert_eq!(result($program, $input, &$matches, $ctx), $expect);
}
};
}
cpu_case!(cpu_push_true, Program {
instructions: vec![Instruction::new(Opcode::PushTrue, 0), Instruction::new(Opcode::Halt, 0)]
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_push_false, Program {
instructions: vec![Instruction::new(Opcode::PushFalse, 0), Instruction::new(Opcode::Halt, 0)]
}, vec![], b"", default_ctx(0, 0, 0, 0), false);
cpu_case!(cpu_push_immediate, Program {
instructions: vec![Instruction::new(Opcode::PushImmediate, 7), Instruction::new(Opcode::Halt, 0)]
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_cmp_eq_true, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 5),
Instruction::new(Opcode::PushImmediate, 5),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_cmp_ne_false, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 5),
Instruction::new(Opcode::PushImmediate, 5),
Instruction::new(Opcode::Neq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), false);
cpu_case!(cpu_cmp_lt, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 2),
Instruction::new(Opcode::PushImmediate, 5),
Instruction::new(Opcode::Lt, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_cmp_gt, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 2),
Instruction::new(Opcode::PushImmediate, 5),
Instruction::new(Opcode::Gt, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), false);
cpu_case!(cpu_cmp_lte, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 3),
Instruction::new(Opcode::PushImmediate, 3),
Instruction::new(Opcode::Lte, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_cmp_gte, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 5),
Instruction::new(Opcode::PushImmediate, 3),
Instruction::new(Opcode::Gte, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_and_true, Program {
instructions: vec![Instruction::new(Opcode::PushTrue, 0), Instruction::new(Opcode::PushTrue, 0), Instruction::new(Opcode::And, 0), Instruction::new(Opcode::Halt, 0)],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_or_true, Program {
instructions: vec![Instruction::new(Opcode::PushFalse, 0), Instruction::new(Opcode::PushTrue, 0), Instruction::new(Opcode::Or, 0), Instruction::new(Opcode::Halt, 0)],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_not_false, Program {
instructions: vec![Instruction::new(Opcode::PushFalse, 0), Instruction::new(Opcode::Not, 0), Instruction::new(Opcode::Halt, 0)],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_add_sub_mul, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 10),
Instruction::new(Opcode::PushImmediate, 2),
Instruction::new(Opcode::Add, 0),
Instruction::new(Opcode::PushImmediate, 4),
Instruction::new(Opcode::Sub, 0),
Instruction::new(Opcode::PushImmediate, 2),
Instruction::new(Opcode::Mul, 0),
Instruction::new(Opcode::PushImmediate, 16),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_div_zero, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 7),
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::Div, 0),
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_mod_zero, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 7),
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::Mod, 0),
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_bit_ops, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0xAA),
Instruction::new(Opcode::PushImmediate, 0x0F),
Instruction::new(Opcode::BitAnd, 0),
Instruction::new(Opcode::PushImmediate, 0x0A),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_shifts, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::PushImmediate, 8),
Instruction::new(Opcode::Shl, 0),
Instruction::new(Opcode::PushImmediate, 256),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_shift_right, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 16),
Instruction::new(Opcode::PushImmediate, 2),
Instruction::new(Opcode::Shr, 0),
Instruction::new(Opcode::PushImmediate, 4),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_push_file_size_lt, Program {
instructions: vec![
Instruction::new(Opcode::PushFileSize, 0),
Instruction::new(Opcode::PushImmediate, 8),
Instruction::new(Opcode::Lt, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"0123456", default_ctx(10, 0, 0, 0), true);
cpu_case!(cpu_push_entropy_gt, Program {
instructions: vec![
Instruction::new(Opcode::PushEntropy, 0),
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::Gt, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"abc", default_ctx(0, 0, 0, 9), false);
cpu_case!(cpu_push_is_pe, Program {
instructions: vec![
Instruction::new(Opcode::PushIsPe, 0),
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 1, 0, 0), true);
cpu_case!(cpu_push_num_sections_eq, Program {
instructions: vec![
Instruction::new(Opcode::PushNumSections, 0),
Instruction::new(Opcode::PushImmediate, 4),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 4), true);
cpu_case!(cpu_push_num_imports_eq, Program {
instructions: vec![
Instruction::new(Opcode::PushNumImports, 0),
Instruction::new(Opcode::PushImmediate, 7),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 7), true);
cpu_case!(cpu_push_entry_point, Program {
instructions: vec![
Instruction::new(Opcode::PushEntryPoint, 0),
Instruction::new(Opcode::PushImmediate, 0x1234),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0x1234), true);
cpu_case!(cpu_push_magic_u32, Program {
instructions: vec![
Instruction::new(Opcode::PushMagicU32, 0),
Instruction::new(Opcode::PushImmediate, 0x11223344),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_push_is_64bit, Program {
instructions: vec![
Instruction::new(Opcode::PushIs64bit, 0),
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 1), true);
cpu_case!(cpu_push_num_strings, Program {
instructions: vec![
Instruction::new(Opcode::PushNumStrings, 0),
Instruction::new(Opcode::PushImmediate, 2),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_push_string_matched_true, Program {
instructions: vec![
Instruction::new(Opcode::PushStringMatched, 0),
Instruction::new(Opcode::Halt, 0),
],
}, match_alpha(1, 4), b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_push_string_matched_false, Program {
instructions: vec![
Instruction::new(Opcode::PushStringMatched, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), false);
cpu_case!(cpu_push_string_count, Program {
instructions: vec![
Instruction::new(Opcode::PushStringCount, 0),
Instruction::new(Opcode::PushImmediate, 3),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, match_alpha(3, 0), b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_push_string_offset, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::PushStringOffset, 0),
Instruction::new(Opcode::PushImmediate, 4),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, match_alpha(2, 4), b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_push_string_offset_missing, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 99),
Instruction::new(Opcode::PushStringOffset, 0),
Instruction::new(Opcode::PushImmediate, u32::MAX),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, match_alpha(1, 10), b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_push_string_length, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::PushStringLength, 0),
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, match_alpha(1, 4), b"Z", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_count_of, Program {
instructions: vec![
Instruction::new(Opcode::PushTrue, 0),
Instruction::new(Opcode::PushFalse, 0),
Instruction::new(Opcode::PushTrue, 0),
Instruction::new(Opcode::PushTrue, 0),
Instruction::new(Opcode::CountOf, (2 << 16) | 4),
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_all_of_true, Program {
instructions: vec![
Instruction::new(Opcode::PushTrue, 0),
Instruction::new(Opcode::PushTrue, 0),
Instruction::new(Opcode::AllOf, 2),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_any_of_false, Program {
instructions: vec![
Instruction::new(Opcode::PushFalse, 0),
Instruction::new(Opcode::PushFalse, 0),
Instruction::new(Opcode::PushFalse, 0),
Instruction::new(Opcode::AnyOf, 3),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), false);
cpu_case!(cpu_string_at_true, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 2),
Instruction::new(Opcode::StringAt, 0),
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, match_alpha(1, 2), b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_string_in_true, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::PushImmediate, 6),
Instruction::new(Opcode::StringIn, 0),
Instruction::new(Opcode::Halt, 0),
],
}, match_alpha(1, 4), b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_for_any_true, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::PushImmediate, 2),
Instruction::new(Opcode::ForAny, (2 << 16) | 2),
Instruction::new(Opcode::PushStringCount, 0),
Instruction::new(Opcode::EndFor, 0),
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), false);
cpu_case!(cpu_for_all_true, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::ForAll, (1 << 16) | 2),
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::StringIn, 0),
Instruction::new(Opcode::EndFor, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![Match { pattern_id: 0, start: 0, end: 1, padding: 0 }], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_for_n_true, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::PushImmediate, 5),
Instruction::new(Opcode::ForN, (1 << 16) | 2),
Instruction::new(Opcode::PushImmediate, 1),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::EndFor, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"", default_ctx(0, 0, 0, 0), true);
cpu_case!(cpu_read_int8_signed, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::ReadIntAt, 1 | (1 << 8)),
Instruction::new(Opcode::PushImmediate, (-1i32 as u32)),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], &[0xFF], default_ctx(1, 0, 0, 0), true);
cpu_case!(cpu_read_int16_le, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::ReadIntAt, 2),
Instruction::new(Opcode::PushImmediate, 0x5A4D),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"\x4D\x5A", default_ctx(2, 0, 0, 0), true);
cpu_case!(cpu_read_int16_be, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::ReadIntAt, 2 | (1 << 9)),
Instruction::new(Opcode::PushImmediate, 0x5A4D),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], b"\x5A\x4D", default_ctx(2, 0, 0, 0), true);
cpu_case!(cpu_read_int32_le, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::ReadIntAt, 4),
Instruction::new(Opcode::PushImmediate, 0x11223344),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], &0x11223344u32.to_le_bytes(), default_ctx(4, 0, 0, 0), true);
cpu_case!(cpu_read_int32_be, Program {
instructions: vec![
Instruction::new(Opcode::PushImmediate, 0),
Instruction::new(Opcode::ReadIntAt, 4 | (1 << 9)),
Instruction::new(Opcode::PushImmediate, 0x11223344),
Instruction::new(Opcode::Eq, 0),
Instruction::new(Opcode::Halt, 0),
],
}, vec![], &0x11223344u32.to_be_bytes(), default_ctx(4, 0, 0, 0), true);