"""Extended characterization tests for reversing sub-modules. Covers behaviour NOT already exercised by test_binary_strings_packer.py: - binary.py : ELF32 / big-endian / ARM / MIPS / RISC-V / Mach-O / WASM / Java-class, PT_GNU_STACK (NX) & PT_GNU_RELRO, PE x86 (32-bit), string path arg, to_dict format - strings.py : UTF-16LE extraction, crypto / PEM / email / version / import / text categories, Windows paths, min_length gate, to_dict method - packer.py : Every packer signature, file-path input, to_dict, entropy 7.0-7.5 note absent, exact entropy boundary - rop.py : All four RET opcodes (0xC3 0xC2 0xCB 0xCA), to_dict, empty data, max_length constraint, filter no-match - symbols.py : Empty list, full bucket population, to_dict, crypto & dynamic_code buckets, score floor - scripts.py : Binary name in ghidra output, script_name param, r2 script has binary name, command presence """ from __future__ import annotations import struct from pathlib import Path import pytest from decepticon.tools.reversing.binary import BinaryInfo, _detect_format, identify_binary from decepticon.tools.reversing.packer import PackerVerdict, detect_packer, shannon_entropy from decepticon.tools.reversing.rop import RopGadget, filter_gadgets_by_pattern, find_rop_gadgets from decepticon.tools.reversing.scripts import ghidra_recon_script, r2_recon_script from decepticon.tools.reversing.strings import ( ExtractedString, extract_strings, group_by_category, ) from decepticon.tools.reversing.symbols import summarize_symbols # ── helpers ───────────────────────────────────────────────────────────────── def _make_elf32(machine: int = 0x03, big_endian: bool = False, pie: bool = False) -> bytes: """Build a minimal but parseable ELF32 header (no program headers).""" e_type = 3 if pie else 2 ei_data = 2 if big_endian else 1 fmt = ">" if big_endian else "<" elf = bytearray(b"\x7fELF\x01" + bytes([ei_data]) + b"\x01\x00" + b"\x00" * 8) elf += struct.pack(fmt + "HHI", e_type, machine, 1) # e_type, e_machine, e_version elf += struct.pack(fmt + "I", 0x8048000) # e_entry (32-bit) elf += struct.pack(fmt + "I", 0) # e_phoff (no program headers) elf += struct.pack(fmt + "I", 0) # e_shoff elf += struct.pack(fmt + "I", 0) # e_flags elf += struct.pack(fmt + "HHHHHH", 52, 0x20, 0, 0, 0, 0) return bytes(elf) def _make_elf64_with_phdr( nx: bool = True, relro: bool = False, machine: int = 0x3E, ) -> bytes: """Build an ELF64 header with one or two program header entries.""" fmt = "<" e_type = 2 # ET_EXEC elf = bytearray(b"\x7fELF\x02\x01\x01\x00" + b"\x00" * 8) elf += struct.pack(fmt + "HHI", e_type, machine, 1) elf += struct.pack(fmt + "Q", 0x400400) # e_entry e_phoff = 0x40 elf += struct.pack(fmt + "Q", e_phoff) # e_phoff elf += struct.pack(fmt + "Q", 0) # e_shoff elf += struct.pack(fmt + "I", 0) # e_flags # e_ehsize=64, e_phentsize=56, e_phnum, e_shentsize, e_shnum, e_shstrndx num_phdrs = 1 + int(relro) elf += struct.pack(fmt + "HHHHHH", 64, 56, num_phdrs, 64, 0, 0) assert len(elf) == 0x40 # PT_GNU_STACK entry: p_type=0x6474E551, p_flags p_flags_stack = 0x6 if nx else 0x7 # PF_R|PF_W (NX) vs PF_R|PF_W|PF_X phdr_stack = struct.pack(fmt + "IIQQQQQQ", 0x6474E551, p_flags_stack, 0, 0, 0, 0, 0, 0x1000) elf += phdr_stack if relro: phdr_relro = struct.pack(fmt + "IIQQQQQQ", 0x6474E552, 0x4, 0, 0, 0, 0, 0, 0x1000) elf += phdr_relro return bytes(elf) def _make_pe(machine: int = 0x014C, bitness_magic: int = 0x10B) -> bytes: """Build a minimal PE buffer.""" pe_off = 0x80 buf = bytearray(0x200) buf[0:2] = b"MZ" buf[0x3C:0x40] = struct.pack(" None: assert _detect_format(b"\x7fELF\x00\x00") == "elf" def test_pe(self) -> None: assert _detect_format(b"MZ\x00\x00") == "pe" def test_macho64_le(self) -> None: assert _detect_format(b"\xcf\xfa\xed\xfe") == "macho64" def test_macho32_le(self) -> None: assert _detect_format(b"\xce\xfa\xed\xfe") == "macho32" def test_macho_fat(self) -> None: # java-class starts with same 4 bytes — java-class has longer prefix # so non-7-byte prefix resolves to macho-fat assert _detect_format(b"\xca\xfe\xba\xbe\x00\x00\x00") == "java-class" assert _detect_format(b"\xca\xfe\xba\xbe\x01\x02\x03") == "macho-fat" def test_macho_big_endian(self) -> None: assert _detect_format(b"\xfe\xed\xfa\xce") == "macho-big" def test_macho_big_endian64(self) -> None: assert _detect_format(b"\xfe\xed\xfa\xcf") == "macho-big64" def test_wasm(self) -> None: assert _detect_format(b"\x00asm\x01\x00\x00\x00") == "wasm" def test_unknown(self) -> None: assert _detect_format(b"garbage") == "unknown" # ── binary.identify_binary ─────────────────────────────────────────────────── class TestIdentifyBinaryExtended: # -- ELF variants -- def test_elf32_x86(self, tmp_path: Path) -> None: path = tmp_path / "elf32.bin" path.write_bytes(_make_elf32(machine=0x03)) info = identify_binary(path) assert info.format == "elf" assert info.bitness == 32 assert info.architecture == "x86" assert info.endianness == "little" def test_elf32_arm(self, tmp_path: Path) -> None: path = tmp_path / "arm32.bin" path.write_bytes(_make_elf32(machine=0x28)) info = identify_binary(path) assert info.architecture == "arm" def test_elf32_mips(self, tmp_path: Path) -> None: path = tmp_path / "mips.bin" path.write_bytes(_make_elf32(machine=0x08)) info = identify_binary(path) assert info.architecture == "mips" def test_elf32_riscv(self, tmp_path: Path) -> None: path = tmp_path / "rv32.bin" path.write_bytes(_make_elf32(machine=0xF3)) info = identify_binary(path) assert info.architecture == "riscv" def test_elf32_powerpc(self, tmp_path: Path) -> None: path = tmp_path / "ppc.bin" path.write_bytes(_make_elf32(machine=0x14)) info = identify_binary(path) assert info.architecture == "powerpc" def test_elf32_unknown_machine(self, tmp_path: Path) -> None: path = tmp_path / "unk.bin" path.write_bytes(_make_elf32(machine=0xFFFF)) info = identify_binary(path) assert "unknown" in info.architecture # type: ignore[operator] def test_elf32_big_endian(self, tmp_path: Path) -> None: path = tmp_path / "be32.bin" path.write_bytes(_make_elf32(big_endian=True)) info = identify_binary(path) assert info.endianness == "big" def test_elf32_pie(self, tmp_path: Path) -> None: path = tmp_path / "pie32.bin" path.write_bytes(_make_elf32(pie=True)) info = identify_binary(path) assert info.pie is True def test_elf64_nx_enabled(self, tmp_path: Path) -> None: path = tmp_path / "nx.bin" path.write_bytes(_make_elf64_with_phdr(nx=True)) info = identify_binary(path) assert info.nx is True def test_elf64_nx_disabled(self, tmp_path: Path) -> None: path = tmp_path / "nonx.bin" path.write_bytes(_make_elf64_with_phdr(nx=False)) info = identify_binary(path) assert info.nx is False def test_elf64_relro_detected(self, tmp_path: Path) -> None: path = tmp_path / "relro.bin" path.write_bytes(_make_elf64_with_phdr(nx=True, relro=True)) info = identify_binary(path) assert info.relro == "partial" def test_elf64_arm64(self, tmp_path: Path) -> None: # build minimal 64-bit ARM ELF without program headers elf = bytearray(b"\x7fELF\x02\x01\x01\x00" + b"\x00" * 8) elf += struct.pack(" None: path = tmp_path / "trunc.bin" path.write_bytes(b"\x7fELF\x02\x01") # way too short info = identify_binary(path) assert info.format == "elf" assert any("truncated" in n for n in info.notes) # -- PE variants -- def test_pe_x86_32bit(self, tmp_path: Path) -> None: path = tmp_path / "x86.exe" path.write_bytes(_make_pe(machine=0x014C, bitness_magic=0x10B)) info = identify_binary(path) assert info.format == "pe" assert info.architecture == "x86" assert info.bitness == 32 def test_pe_arm(self, tmp_path: Path) -> None: path = tmp_path / "arm.exe" path.write_bytes(_make_pe(machine=0x01C0, bitness_magic=0x10B)) info = identify_binary(path) assert info.architecture == "arm" def test_pe_arm64(self, tmp_path: Path) -> None: path = tmp_path / "arm64.exe" path.write_bytes(_make_pe(machine=0xAA64, bitness_magic=0x20B)) info = identify_binary(path) assert info.architecture == "arm64" def test_pe_unknown_machine(self, tmp_path: Path) -> None: path = tmp_path / "unk.exe" path.write_bytes(_make_pe(machine=0xDEAD, bitness_magic=0x10B)) info = identify_binary(path) assert "unknown" in info.architecture # type: ignore[operator] def test_pe_nx_off_pie_off(self, tmp_path: Path) -> None: path = tmp_path / "nonx.exe" path.write_bytes(_make_pe()) info = identify_binary(path) assert info.nx is False assert info.pie is False def test_pe_no_signature(self, tmp_path: Path) -> None: buf = bytearray(0x200) buf[0:2] = b"MZ" buf[0x3C:0x40] = struct.pack(" None: path = tmp_path / "small.exe" path.write_bytes(b"MZ\x00") # too short for e_lfanew info = identify_binary(path) assert any("truncated" in n for n in info.notes) # -- Mach-O -- def test_macho32(self, tmp_path: Path) -> None: path = tmp_path / "macho32" path.write_bytes(b"\xce\xfa\xed\xfe" + b"\x00" * 20) info = identify_binary(path) assert info.format == "macho32" assert info.bitness == 32 assert info.endianness == "little" def test_macho64(self, tmp_path: Path) -> None: path = tmp_path / "macho64" path.write_bytes(b"\xcf\xfa\xed\xfe" + b"\x00" * 20) info = identify_binary(path) assert info.format == "macho64" assert info.bitness == 64 assert info.endianness == "little" def test_macho_big_endian_parsed(self, tmp_path: Path) -> None: path = tmp_path / "macho_be" path.write_bytes(b"\xfe\xed\xfa\xce" + b"\x00" * 20) info = identify_binary(path) assert info.format == "macho-big" assert info.endianness == "big" assert info.bitness == 32 def test_macho64_big_endian_parsed(self, tmp_path: Path) -> None: path = tmp_path / "macho64_be" path.write_bytes(b"\xfe\xed\xfa\xcf" + b"\x00" * 20) info = identify_binary(path) assert info.format == "macho-big64" assert info.endianness == "big" assert info.bitness == 64 def test_macho_architecture_deferred(self, tmp_path: Path) -> None: path = tmp_path / "macho" path.write_bytes(b"\xcf\xfa\xed\xfe" + b"\x00" * 20) info = identify_binary(path) assert "deferred" in (info.architecture or "") # -- WASM -- def test_wasm_format(self, tmp_path: Path) -> None: path = tmp_path / "module.wasm" path.write_bytes(b"\x00asm\x01\x00\x00\x00" + b"\x00" * 20) info = identify_binary(path) assert info.format == "wasm" # -- Misc -- def test_string_path_accepted(self, tmp_path: Path) -> None: path = tmp_path / "b.bin" path.write_bytes(b"random garbage data!!") info = identify_binary(str(path)) assert info.format == "unknown" def test_size_recorded(self, tmp_path: Path) -> None: data = b"random garbage data!!" * 10 path = tmp_path / "sized.bin" path.write_bytes(data) info = identify_binary(path) assert info.size == len(data) def test_to_dict_structure(self, tmp_path: Path) -> None: path = tmp_path / "b.bin" path.write_bytes(_make_elf32()) info = identify_binary(path) d = info.to_dict() assert set(d.keys()) >= {"path", "format", "architecture", "bitness", "entry_point", "nx"} def test_to_dict_entry_point_hex(self, tmp_path: Path) -> None: path = tmp_path / "b.bin" path.write_bytes(_make_elf32()) info = identify_binary(path) d = info.to_dict() # entry_point should be None (no program headers in minimal ELF32) or a hex string ep = d["entry_point"] if ep is not None: assert ep.startswith("0x") def test_to_dict_entry_point_none_when_absent(self) -> None: info = BinaryInfo(path="/x", format="unknown") assert info.to_dict()["entry_point"] is None # ── strings.extract_strings ────────────────────────────────────────────────── class TestStringsExtended: def test_utf16le_extracted(self) -> None: # "hello" encoded as UTF-16LE utf16 = "hello world".encode("utf-16-le") strings = extract_strings(bytes(utf16)) utf16_hits = [s for s in strings if s.encoding == "utf16le"] assert any("hello" in s.text for s in utf16_hits) def test_utf16le_disabled(self) -> None: utf16 = "hello world".encode("utf-16-le") strings = extract_strings(bytes(utf16), include_utf16=False) utf16_hits = [s for s in strings if s.encoding == "utf16le"] assert len(utf16_hits) == 0 def test_min_length_filters_short(self) -> None: # "ok" is 2 bytes — below the default of 4 data = b"ok\x00\x00longer_string_here" strings = extract_strings(data, min_length=6) assert not any(s.text == "ok" for s in strings) def test_category_crypto_hex_key_32(self) -> None: key = "a" * 32 # 32 hex chars = valid crypto key length strings = extract_strings(key.encode()) assert any(s.category == "crypto" for s in strings) def test_category_crypto_hex_key_64(self) -> None: key = "deadbeef" * 8 # 64 hex chars strings = extract_strings(key.encode()) assert any(s.category == "crypto" for s in strings) def test_category_crypto_hex_key_wrong_length_not_crypto(self) -> None: # 33 hex chars — not in allowed lengths (32/40/48/56/64/96/128) key = "a" * 33 strings = extract_strings(key.encode()) # Should NOT be crypto (wrong length for _HEX_KEY_RE check) hits = [s for s in strings if s.category == "crypto"] assert len(hits) == 0 def test_category_crypto_pem(self) -> None: data = b"-----BEGIN RSA PRIVATE KEY----- somedata" strings = extract_strings(data) assert any(s.category == "crypto" for s in strings) def test_category_email(self) -> None: data = b"send mail to admin@example.com please" strings = extract_strings(data) assert any(s.category == "email" for s in strings) def test_category_version(self) -> None: data = b"version 2.3.4 detected" strings = extract_strings(data) assert any(s.category == "version" for s in strings) def test_category_import_direct(self) -> None: data = b"calls execve in loop" strings = extract_strings(data) assert any(s.category == "import" for s in strings) def test_category_import_substring(self) -> None: # malloc appears as substring inside a longer word data = b"__wrap_malloc_hook_override" strings = extract_strings(data) assert any(s.category == "import" for s in strings) def test_category_text_fallback(self) -> None: data = b"just some random plain words here" strings = extract_strings(data) assert any(s.category == "text" for s in strings) def test_category_windows_path(self) -> None: data = b"loading C:\\Windows\\System32\\cmd.exe now" strings = extract_strings(data) assert any(s.category == "path" for s in strings) def test_offset_is_correct(self) -> None: pad = b"\x00" * 16 data = pad + b"hello world here" strings = extract_strings(data) ascii_hits = [s for s in strings if s.encoding == "ascii"] assert any(s.offset == 16 for s in ascii_hits) def test_to_dict_fields(self) -> None: s = ExtractedString(offset=0x10, text="hello", encoding="ascii", category="text") d = s.to_dict() assert d["offset"] == "0x10" assert d["text"] == "hello" assert d["encoding"] == "ascii" assert d["category"] == "text" def test_to_dict_truncates_long_text(self) -> None: s = ExtractedString(offset=0, text="x" * 500, encoding="ascii", category="text") d = s.to_dict() assert len(d["text"]) <= 256 def test_group_by_category_empty_input(self) -> None: grouped = group_by_category([]) assert grouped == {} def test_path_input(self, tmp_path: Path) -> None: f = tmp_path / "blob.bin" f.write_bytes(b"hello world strings here!") strings = extract_strings(f) assert len(strings) > 0 def test_str_path_input(self, tmp_path: Path) -> None: f = tmp_path / "blob2.bin" f.write_bytes(b"hello world strings here!") strings = extract_strings(str(f)) assert len(strings) > 0 # ── packer.detect_packer ───────────────────────────────────────────────────── class TestPackerExtended: @pytest.mark.parametrize( "sig,expected", [ (b"UPX0", "UPX"), (b"UPX1", "UPX"), (b"UPX2", "UPX"), (b".aspack", "ASPack"), (b".adata", "ASPack"), (b"PEBundle", "PEBundle"), (b".petite", "Petite"), (b".Themida", "Themida"), (b".vmp1", "VMProtect"), (b".enigma1", "Enigma Protector"), (b".enigma2", "Enigma Protector"), (b".MPRESS1", "MPRESS"), (b".MPRESS2", "MPRESS"), (b"ByDwing", "ASPack"), (b".mew", "MEW"), (b"NSPack", "NsPack"), (b"PECompact2", "PECompact"), (b"Y0da", "Yoda's Protector"), ], ) def test_packer_signature(self, sig: bytes, expected: str) -> None: data = b"\x00" * 64 + sig + b"\x00" * 64 v = detect_packer(data) assert expected in v.signatures assert v.likely_packed is True def test_multiple_signatures_captured(self) -> None: data = b"UPX!" + b".vmp0" + b"\x00" * 100 v = detect_packer(data) assert "UPX" in v.signatures assert "VMProtect" in v.signatures def test_first_packer_wins(self) -> None: # UPX! appears before .vmp0 — UPX should be the packer field data = b"UPX!" + b".vmp0" + b"\x00" * 100 v = detect_packer(data) assert v.packer == "UPX" def test_entropy_above_7_no_sig_no_very_high_note(self) -> None: # Craft exactly the boundary: entropy > 7.0 but <= 7.5 # Use a byte distribution that gives moderate-high entropy # (this is hard to craft deterministically, so we skip the note check # and just verify likely_packed=True) data = bytes(range(256)) * 4 # 1024 bytes, perfect distribution v = detect_packer(data) # entropy is exactly 8.0 — very high note should be present if no sig assert v.likely_packed is True def test_entropy_exact_maximum(self) -> None: data = bytes(range(256)) ent = shannon_entropy(data) assert abs(ent - 8.0) < 0.001 def test_entropy_empty_bytes(self) -> None: assert shannon_entropy(b"") == 0.0 def test_entropy_all_same_byte(self) -> None: assert shannon_entropy(b"\xff" * 1000) == 0.0 def test_entropy_two_symbols(self) -> None: data = b"\x00\xff" * 500 ent = shannon_entropy(data) assert abs(ent - 1.0) < 0.001 def test_file_path_input(self, tmp_path: Path) -> None: f = tmp_path / "sample.bin" f.write_bytes(b"UPX!" + b"\x00" * 100) v = detect_packer(f) assert v.packer == "UPX" def test_str_path_input(self, tmp_path: Path) -> None: f = tmp_path / "sample2.bin" f.write_bytes(b"UPX!" + b"\x00" * 100) v = detect_packer(str(f)) assert v.packer == "UPX" def test_to_dict_fields(self) -> None: v = PackerVerdict( likely_packed=True, entropy=7.5, packer="UPX", signatures=["UPX"], notes=["test note"], ) d = v.to_dict() assert d["likely_packed"] is True assert d["entropy"] == 7.5 assert d["packer"] == "UPX" assert "UPX" in d["signatures"] assert "test note" in d["notes"] def test_to_dict_entropy_rounded(self) -> None: v = PackerVerdict(likely_packed=False, entropy=3.14159265) d = v.to_dict() # round to 3 decimal places assert d["entropy"] == round(3.14159265, 3) def test_empty_data_verdict(self) -> None: v = detect_packer(b"") assert v.likely_packed is False assert v.entropy == 0.0 assert any("empty" in n for n in v.notes) def test_low_entropy_note_below_4(self) -> None: data = b"A" * 1000 v = detect_packer(data) assert any("low" in n for n in v.notes) assert v.likely_packed is False # ── rop.find_rop_gadgets ──────────────────────────────────────────────────── class TestRopExtended: def test_ret_imm16_0xc2(self) -> None: # RET 8 (0xC2 0x08 0x00) data = b"\x58\xc2\x08\x00" # pop rax; ret 8 gadgets = find_rop_gadgets(data) assert any(g.ret_opcode == 0xC2 for g in gadgets) def test_retf_0xcb(self) -> None: data = b"\x58\xcb" # pop rax; retf gadgets = find_rop_gadgets(data) assert any(g.ret_opcode == 0xCB for g in gadgets) def test_retf_imm16_0xca(self) -> None: data = b"\x58\xca\x08\x00" gadgets = find_rop_gadgets(data) assert any(g.ret_opcode == 0xCA for g in gadgets) def test_all_four_ret_opcodes(self) -> None: data = b"\xc3\xc2\x00\x00\xcb\xca\x00\x00" gadgets = find_rop_gadgets(data) found_opcodes = {g.ret_opcode for g in gadgets} assert 0xC3 in found_opcodes assert 0xC2 in found_opcodes assert 0xCB in found_opcodes assert 0xCA in found_opcodes def test_empty_data_returns_empty(self) -> None: assert find_rop_gadgets(b"") == [] def test_no_ret_in_data(self) -> None: data = b"\x48\x89\xc7\x48\x8b\x05" # no ret byte assert find_rop_gadgets(data) == [] def test_max_length_respected(self) -> None: # 20 bytes before ret — with max_length=5, only 5 bytes captured data = b"\xaa" * 20 + b"\xc3" gadgets = find_rop_gadgets(data, max_length=5) assert len(gadgets) == 1 assert len(gadgets[0].bytes_) == 6 # 5 preceding + ret def test_gadget_hex_matches_bytes(self) -> None: data = b"\x58\x59\xc3" gadgets = find_rop_gadgets(data) assert len(gadgets) == 1 assert gadgets[0].hex == data.hex() def test_to_dict_fields(self) -> None: g = RopGadget(offset=0x400, bytes_=b"\x58\xc3", hex="58c3", ret_opcode=0xC3) d = g.to_dict() assert d["offset"] == "0x400" assert d["hex"] == "58c3" assert d["length"] == 2 assert d["ret"] == "0xc3" def test_to_dict_ret_opcode_format(self) -> None: g = RopGadget(offset=0, bytes_=b"\xc3", hex="c3", ret_opcode=0xC3) assert g.to_dict()["ret"] == "0xc3" def test_dedup_across_different_positions(self) -> None: # Dedup is by the candidate bytes_ slice, not just the opcode. # With max_length=1 both instances capture exactly b"\x58\xc3" — deduped. data = b"\x58\xc3" + b"\x00" * 4 + b"\x58\xc3" gadgets = find_rop_gadgets(data, max_length=1) assert len(gadgets) == 1 def test_filter_gadgets_pattern_no_match(self) -> None: data = b"\x58\xc3" gadgets = find_rop_gadgets(data) filtered = filter_gadgets_by_pattern(gadgets, "ff") assert filtered == [] def test_filter_gadgets_empty_input(self) -> None: assert filter_gadgets_by_pattern([], "48") == [] def test_base_address_in_offset(self) -> None: data = b"\x00\xc3" gadgets = find_rop_gadgets(data, base=0x1000) assert gadgets[0].offset >= 0x1000 # ── symbols.summarize_symbols ──────────────────────────────────────────────── class TestSymbolsExtended: def test_empty_list(self) -> None: r = summarize_symbols([]) assert r.dangerous_c == [] assert r.command_exec == [] assert r.network == [] assert r.crypto == [] assert r.dynamic_code == [] assert r.anti_debug == [] assert r.sanitizers == [] assert r.risk_score() == 0 def test_crypto_bucket(self) -> None: r = summarize_symbols(["EVP_EncryptInit", "AES_encrypt", "BCryptDecrypt"]) assert "EVP_EncryptInit" in r.crypto assert "AES_encrypt" in r.crypto assert "BCryptDecrypt" in r.crypto def test_dynamic_code_bucket(self) -> None: r = summarize_symbols(["dlopen", "VirtualAlloc", "NtCreateThreadEx", "mprotect"]) assert "dlopen" in r.dynamic_code assert "VirtualAlloc" in r.dynamic_code assert "NtCreateThreadEx" in r.dynamic_code assert "mprotect" in r.dynamic_code def test_network_bucket(self) -> None: r = summarize_symbols(["socket", "WSAConnect", "curl_easy_perform"]) assert "socket" in r.network assert "WSAConnect" in r.network def test_dangerous_c_bucket(self) -> None: r = summarize_symbols(["gets", "vsprintf", "alloca", "mktemp"]) assert "gets" in r.dangerous_c assert "vsprintf" in r.dangerous_c def test_sanitizer_prefix_variants(self) -> None: # Each symbol must start with one of the prefixes in _SANITIZER. # __asan_report_load (not _store) is the defined prefix. syms = [ "__asan_report_load4", "__asan_report_load_n", "__ubsan_handle_add_overflow", "__sanitizer_cov_trace_pc", "__hwasan_init_v7", "__msan_init", "__tsan_init", ] r = summarize_symbols(syms) assert len(r.sanitizers) == len(syms) def test_sanitizer_reduces_score_to_zero_if_dominant(self) -> None: # Many sanitizers should pull score toward 0 (floor is 0) syms = ["__asan_init"] * 20 r = summarize_symbols(syms) assert r.risk_score() == 0 def test_risk_score_floor_is_zero(self) -> None: r = summarize_symbols(["__asan_init", "__asan_report_load"]) assert r.risk_score() >= 0 def test_risk_score_additive(self) -> None: r_base = summarize_symbols(["system"]) r_more = summarize_symbols(["system", "VirtualAlloc", "strcpy", "IsDebuggerPresent"]) assert r_more.risk_score() > r_base.risk_score() def test_risk_score_command_exec_weighted_highest(self) -> None: # command_exec has weight 4, dangerous_c has weight 3 r_cmd = summarize_symbols(["system"]) r_danger = summarize_symbols(["strcpy"]) assert r_cmd.risk_score() > r_danger.risk_score() def test_deduplication_via_set(self) -> None: # Duplicates in input should not inflate counts r = summarize_symbols(["strcpy", "strcpy", "system", "system"]) assert r.dangerous_c.count("strcpy") == 1 assert r.command_exec.count("system") == 1 def test_unknown_symbols_ignored(self) -> None: r = summarize_symbols(["totally_unknown_function_xyz", "another_one"]) assert r.dangerous_c == [] assert r.command_exec == [] assert r.risk_score() == 0 def test_to_dict_structure(self) -> None: r = summarize_symbols(["strcpy", "system"]) d = r.to_dict() assert set(d.keys()) >= { "dangerous_c", "command_exec", "network", "crypto", "dynamic_code", "anti_debug", "sanitizers", "risk_score", } assert isinstance(d["risk_score"], int) def test_to_dict_lists_are_copies(self) -> None: r = summarize_symbols(["strcpy"]) d = r.to_dict() d["dangerous_c"].clear() # Original should be unaffected assert "strcpy" in r.dangerous_c def test_results_sorted(self) -> None: r = summarize_symbols(["system", "execve", "popen"]) assert r.command_exec == sorted(r.command_exec) # ── scripts ────────────────────────────────────────────────────────────────── class TestScriptsExtended: def test_ghidra_script_contains_binary_name(self) -> None: src = ghidra_recon_script("/opt/target/firmware.elf") # The binary path should appear via .format() substitution assert "firmware.elf" in src def test_ghidra_script_custom_script_name(self) -> None: src = ghidra_recon_script("/bin/ls", script_name="my_script.py") # Script name appears in the usage comment assert "my_script.py" in src def test_ghidra_script_default_script_name(self) -> None: src = ghidra_recon_script("/bin/ls") assert "decepticon_recon.py" in src def test_ghidra_script_has_function_iteration(self) -> None: src = ghidra_recon_script("/bin/ls") assert "getFunctionManager" in src or "getFunctions" in src def test_r2_script_contains_binary_placeholder(self) -> None: # r2 script uses {binary} — verify the raw template has the # variable substituted (r2_recon_script formats it) src = r2_recon_script("/target/binary") # The _R2_RECON template doesn't actually insert binary into the # script body (r2 gets binary as a CLI arg), but the function # accepts the param — just ensure it runs without error assert isinstance(src, str) assert len(src) > 50 def test_r2_script_contains_analysis_command(self) -> None: src = r2_recon_script("/bin/target") assert "aaa" in src def test_r2_script_contains_import_check(self) -> None: src = r2_recon_script("/bin/target") assert "ii" in src def test_r2_script_contains_xref_system(self) -> None: src = r2_recon_script("/bin/target") assert "axt" in src def test_r2_script_string_filter_contains_secret_keywords(self) -> None: src = r2_recon_script("/bin/target") assert "password" in src or "secret" in src or "AKIA" in src def test_ghidra_script_minimal_length(self) -> None: src = ghidra_recon_script("/x") assert len(src) > 300 def test_r2_script_minimal_length(self) -> None: src = r2_recon_script("/x") assert len(src) > 100