Add test case for magic field in macho module.

This should confirm an issue with the endianness of `magic` field in big-endian platforms.
VirusTotal · Jan 30, 2024 · e065be6 · e065be6
1 parent f5edf4e
commit e065be6
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/tests/test-macho.c b/tests/test-macho.c
@@ -234,6 +234,12 @@ int main(int argc, char** argv)
     macho.file[1].cputype == macho.fat_arch[1].cputype }",
       "tests/data/tiny-universal");
 
+  assert_true_rule_file(
+      "import \"macho\" rule test { condition: \
+    macho.file[0].magic == 0xfeedface and \
+    macho.file[1].magic == 0xfeedfacf }",
+      "tests/data/tiny-universal");
+
   // Entry points for files (LC_MAIN)
 
   assert_true_rule_file(