Add test for macho magic numbers.

VirusTotal · Jan 30, 2024 · 74c6692 · 74c6692
1 parent ff4a923
commit 74c6692
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/tests/test-macho.c b/tests/test-macho.c
@@ -234,6 +234,12 @@ int main(int argc, char** argv)
     macho.file[1].cputype == macho.fat_arch[1].cputype }",
       "tests/data/tiny-universal");
 
+  assert_true_rule_file(
+      "import \"macho\" rule test { condition: \
+    macho.file[0].magic == 0xfeedface /* 0xcefaedfe */ and \
+    macho.file[1].magic == 0xfeedfacf /* 0xcffaedfe */ }",
+      "tests/data/tiny-universal");
+
   // Entry points for files (LC_MAIN)
 
   assert_true_rule_file(