mirror of
https://github.com/Cisco-Talos/clamav.git
synced 2026-01-22 05:38:39 -05:00
201e1b12a7
The split test files are flagged by some AV's because they look like broken executables. Instead of splitting the test files to prevent detections, we should encrypt them. This commit replaces the "reassemble testfiles" script with a basic "XOR testfiles" script that can be used to encrypt or decrypt test files. This commit also of course then replaces all the split files with xor'ed files. The test and unit_tests directories were a bit of a mess, so I reorganized them all into unit_tests with all of the test files placed under "unit_tests/input" using subdirectories for different types of files.
49 lines
9.9 KiB
Plaintext
49 lines
9.9 KiB
Plaintext
ClamBCafhne`lekkd|afefdfggifnf```ca`a```|alcflfafmfbfcfmb`cnbacac``bccaap`clamcoincidencejb:1419
|
|
.{ClamAV-Test-File-detected-via-bytecode};Target:1;(0&2&1);0:4d5a50000200000004000f00ffff0000;EOF-544:4d5a50000200000004000f00ffff0000;S0+0:4d5a50000200000004000f00ffff0000
|
|
Tedebbgebageb`gebofebnfebmfebgeeblfebkfebjfebdfebcfebbfebheebafeboeebadebcddaeahdakahaaaaaaaa`aabb`bb`baacb`bbadb`baacb`bb`bb`baadb`bbadbadb`bcafahb`fahb`fahb`fcaab`ddb`db`bdbccahdbfaahcamb`bb`bb`ab`abefbffb`bbgfbhfb`bb`bb`bb`bcahb`bb`ab`ab`bb`bb`bb`ab`acboab`aahahb`bb`bb`bb`bb`bb`bb`bb`bb`bb`ab`ab`ab`ab`ab`ab`bb`bb`bb`bb`ab`ab`bb`bb`bb`bb`bb`bbhfcbnab`aahahb`bb`bb`bb`bb`bb`db`bb`bb`ab`ab`ab`ab`ab`ab`bb`bb`bb`bb`ab`ab`db`db`db`db`bb`bbhfdb`abifcabb`bb`bdbeaahdbnbahdbkaahdbfbahdbibahdbcbahdaabaddbgbahdaaah
|
|
Eaoafagbke|baadfefbfeggfoe`gbgifnfdgoeegifnfdg``aobke|ak`gefoebgafggafdfdfbg``afble|b`adfefbfeggfoe`gbgifnfdgoecgdgbg``abble|aebgefafdf``adbme|aecgefefkf``aeble|amcgefdgfgifbgegcgnfafmfef``
|
|
Gdc``hbgb`@`bbg@`bagBcdBlfBafBmfBadBfeBmbBdeBefBcgBdgBmbBfdBifBlfBefBmbBdfBefBdgBefBcfBdgBefBdfBmbBfgBifBafBmbBbfBigBdgBefBcfBofBdfBef@`b`g@Ab`b`aAa`bofB`cBjcBdcBdfBecBafBecB`cB`cB`cB`cBbcB`cB`cB`cB`cB`cB`cB`cBdcB`cB`cB`cBffB`cB`cBffBffBffBffB`cB`cB`cB`c@`bnfBedBodBfdBmbBecBdcBdcBjcBdcBdfBecBafBecB`cB`cB`cB`cBbcB`cB`cB`cB`cB`cB`cB`cBdcB`cB`cB`cBffB`cB`cBffBffBffBffB`cB`cB`cB`c@`bmfBceB`cBkbB`cBjcBdcBdfBecBafBecB`cB`cB`cB`cBbcB`cB`cB`cB`cB`cB`cB`cBdcB`cB`cB`cBffB`cB`cBffBffBffBffB`cB`cB`cB`c@`b`aCa`a`bgeBedB`eBjcB`b@`blfBcdBofBegBlfBdfBnfBgbBdgB`bBbgBefBafBdfB`bBecB`bBbfBigBdgBefBcgB`bB`dBedB`eAj@`bkfBndBofB`bBgbBmfBofBfgB`bBefBbfBhgBlbB`bBcfBigB`gBhfBefBbgBdgBefBhgBdgBgbB`bBffBofBegBnfBdfB`bBafBdgB`bBefBnfBdgBbgBigB`gBofBifBnfBdgAj@`bjfBfeBadB`bBofBffB`bBcfBigB`gBhfBefBbgBdgBefBhgBdgB`bBifBcgB`b@`bcfBbeBfeBadB`bBofBffB`bBcfBigB`gBhfBefBbgBdgBefBhgBdgB`bBifBcgB`b@`bbfBcdBafBnfBgbBdgB`bBlfBofBcfBafBdgBefB`bBdgBhfBefB`bB`gBhfBifBcgBifBcfBafBlfB`bBofBffBffBcgBefBdgB`bBofBffB`bBdgBhfBefB`bBcfBigB`gBhfBefBbgBdgBefBhgBdg@`bcfBcdBigB`gBhfBefBbgBdgBefBhgBdgB`bBcgBdgBafBbgBdgBcgB`bBafBdgB`b@`bofBcdBafBnfBgbBdgB`bBbgBefBafBdfB`bBacB`cB`bBbfBigBdgBefBcgB`bBofBffB`bBcfBigB`gBhfBefBbgBdgBefBhgBdgAj@`bheBhdBedBldBldBodB`bBgeBodBbeBmd@`boe@@@Aa@Ab`bad@Ab`bad@Ab`bad@Ae`bad@Af`bad@Ag`bad@Ai`bad@Aj`bad@Ak`bad@Al`bad@Dc``h`bcdB`dDc``h`bcdAdDc``h`bad@Am`bad@An`bad@Ao`bad@B`a`bad@Baa`bcdAhD```h`bcdAdD```h`bcd@D```h`
|
|
A`b`bLbneb`bab`babgeabheab`b`b`b`b`b`b`b`bad`b`b`aa`b`b`ah`aa`b`b`bad`b`b`aa`````b`b`b`b`b`b`b`b`````b`b`b`b`b`b`b`b`b`b`aa`b`b`b`b`b`b`b`b`bad`b`b`aa`b`b`ah`ah```bad`ah`ah`ah```bad`ah`ah`ah```bad`ah`ah`ah```bad`ah`ah`ah```bad`ah`ah`ah```bad`ah`ah`ah```bad`ah`ah`ah```bad`ah`ah`ah```bad`ah`ah`ah```b`b`aa`bad```b`b`b`b`Fbifao
|
|
Bb`badgbBna`b`baeabbafBha`@db`bafabaagadb`bagabbadad@dbadahdbbkdab@db`baiabbabahAedaaajeab`baiAedTaaajabaa
|
|
Bb`bakabbafBia`@dTcab`b@d
|
|
BahalgbahaaameaahalBkkaTaaamadac
|
|
Bb`banabbafBja`@dTcab`b@d
|
|
BbadaodbbkdabAadb`bb`agbaoaabaalb``bbb`aaaTaabaaaeaf
|
|
Bb`baaobb`aTbaaf
|
|
Bb`bbdabbaabdab`bbeaabbafBka`@db`bbfaabaagbdab`bbgagbBma```bbbga`Taabaaagah
|
|
Bb`b`obbgaTbaah
|
|
Bb`bbjabb`bjab`bbkab`bdabjab`bblaabbafBoa`@db`bbmaabaagbkab`bbnaabaaobkaaaboaeab`bbnaHoooooooodTaaboaaiaj
|
|
Bb`bb`babbafB`b`@dTcab`b@d
|
|
Bb`bbababbafBab`@db`bbbbabaagbnab`bbcbabbadbna@dbadbdbdbbbeac@db`bbebabbabbdbAjdaabfbeab`bbebAjdTaabfbalak
|
|
Bb`bbgbabbafBbb`@dTcab`b@d
|
|
Bahbhbgbbdbahbibm`bhbBjba``fbbibbdbbadbkbdbbbeacAadahblba`bibAaaahbmbgbbkbahbnbm`blbbmb``fbbnbbkbbadb`cdbbbeacAbdahbaca`bnbAaaahbbcgbb`cahbccm`bacbbc``fbbccb`cbadbecdbbbeacAcdahbfca`bccAaaahbgcgbbecahbhcm`bfcbgc``fbbhcbecbadbjcdbbbeacAddahbkca`bhcAaaahblcgbbjcahbmcm`bkcblc``fbbmcbjcbadbocdbbbeacAedahb`da`bmcAaaahbadgbbocahbbdm`b`dbad``fbbbdbocbadbdddbbbeacAfdahbeda`bbdAaaahbfdgbbddahbgdm`bedbfd``fbbgdbddbadbiddbbbeacAgdahbjda`bgdAaaahbkdgbbidahbldm`bjdbkd``fbbldbidbadbnddbbbeacAhdahboda`bldAaaahb`egbbndahbaem`bodb`e``fbbaebndbadbcedbbbeacAidahbdea`baeAaaahbeegbbceahbfem`bdebee``fbbfebceb`bbhekbbdbBcb`Ajdaabieeab`bbhe@dTaabieaman
|
|
BbadbjedbbbeacAjd``fb@abjeb`bbleabbafbdb@db`bbmeabbaeBda`@dTcab`b@d
|
|
BTcab`b@dE
|
|
Sfeidbeeecendadmdedoe`ebeedfdidhehbbbbbibSfeidbeeecendadmdedcehbbbcdlfafmfadfembdeefcgdgmbfdiflfefmbdfefdgefcfdgefdfmbfgifafmbbfigdgefcfofdfefbbibSdeadbegdeddehbacib
|
|
Sobjb`bdehfifcg`bifcg`baflflf`bdfegmfmfig`bcgdgegffff`bjbobSceidgdndaddeeebeedceoeddedcdldoebdedgdidndSddedcdldadbeedoeceidgdndaddeeebeedhbmdjeffbgofmfbdodfdibSddedcdldadbeedoeceidgdndaddeeebeedhbmdjeffbgofmfedodfdib
|
|
ddedcdldadbeedoeceidgdndaddeeebeedhbmdjeffbgofmfce`cibSceidgdndaddeeebeedceoeddedcdldoeedndddSSceidgdndaddeeebeedceoeddedfdoebdedgdidndSddedfdidndedoeceidgdndaddeeebeedhbmdjeffbgofmfbdodfdlb`b`b`b`b`b`b`bbb`cjcdcdfecafec`c`c`c`cbc`c`c`c`c`c`c`cdc`c`c`cff`c`cffffffff`c`c`c`cbbib
|
|
ddedfdidndedoeceidgdndaddeeebeedhbmdjeffbgofmfedodfdlb`bbbedodfdmbecdcdcjcdcdfecafec`c`c`c`cbc`c`c`c`c`c`c`cdc`c`c`cff`c`cffffffff`c`c`c`cbbibSddedfdidndedoeceidgdndaddeeebeedhbmdjeffbgofmfce`clb`b`b`b`b`bbbce`ckb`cjcdcdfecafec`c`c`c`cbc`c`c`c`c`c`c`cdc`c`c`cff`c`cffffffff`c`c`c`cbbib
|
|
ceidgdndaddeeebeedceoeedndddSS`eedoeeend`eadcdkdedbeoeddedcdldadbeedSSbfofoflf`blfofgfifcfaflfoedgbgifgfgfefbghbfgofifdfibSkgSbgefdgegbgnf`bmfafdgcfhfefcghbceifgfnfafdgegbgefcgnbmdjeffbgofmfbdodfdib`bfbfb`bmfafdgcfhfefcghbceifgfnfafdgegbgefcgnbmdjeffbgofmfedodfdib`bfbfb`bmfafdgcfhfefcghbceifgfnfafdgegbgefcgnbmdjeffbgofmfce`cibkc
|
|
mgSobjb`bddegmfmfig`bcgdgegffff`befnfdfcg`bhfefbgef`bjbobSSifnfdg`befnfdgbgig`gofifnfdghbib`bkgSobob`bgdefdg`bdghfef`befnfdgbgig`b`gofifnfdg`bodfdfdceeddeSegifnfdgccbcoedg`bef`g`bmc`bgfefdgednfdgbgig`eofifnfdghbibkc
|
|
dfefbfeggfhbbbed`ejc`bbbibkc`bdfefbfeggfhbef`gibkcSSobob`bmdoffgef`bdgof`bdghfef`befnfdgbgig`b`gofifnfdg`bofffffcgefdg`bifnf`bdghfef`bffiflfefScgefefkfhbef`glb`bceededkdoeceeddeibkc
|
|
Sobjb`bhdefbgef`bggef`blfofofkf`bffofbg`bmfoffg`befbfhglb`bfgaflfegefSdehfef`bdfifcgafcgcgefmfbflfefbg`bifcg`bhfofggeffgefbg`bnfofdg`bigefdg`bifnfdgefgfbgafdgefdf`bifnf`bdghfef`bbfcf`bcgof`bffofbg`bnfofgg`bggef`bcfhfefcfkf
|
|
mfafnfegaflflfig`bifff`bifdggbcg`baf`bmfoffgnb`bidnf`bhfefhg`bifdg`bcghfofeglfdf`bbfef`bbfbfccccbcbcacac`c`c`bffofbg`bmfoffg`befbfhglb`b`c`cacacbcbccccc`bSdghfafdg`bifcg`bec`bbfigdgefcg`boffgefbgaflflfnb
|
|
jbobSobob`bmdafkfef`bbgofofmf`bffofbg`bdghfef`bec`bbfigdgefcg`bdgof`bbfef`bbgefafdfSegifnfdghcoedg`bffifbgcgdgoeof`gkeecmekcSobob`bbeefafdf`bec`bbfigdgefcgSifffhbbgefafdfhbffifbgcgdgoeof`glb`becibabmcecib`bkg
|
|
dfefbfeggfhbbbcdofeglfdfnfgbdg`bbgefafdf`bec`bbfigdgefcg`b`ded`elenfbbibkcSbgefdgegbgnf`b`ckcSmgSSobob`bcdhfefcfkf`bifff`bdghfef`bffifbgcgdg`bbfigdgef`bhbafkfaf`bffifbgcgdgoeof`gke`cmeib`bifcg`bbfbf
|
|
ifffhbffifbgcgdgoeof`gke`cme`babmc`b`chgbfbfib`bkgSdfefbfeggfhbbbndof`bgbmfoffg`befbfhglb`bcfig`ghfefbgdgefhgdggb`bffofegnfdf`bafdg`befnfdgbgig`gofifnfdglenfbbibkc
|
|
bgefdgegbgnf`b`ckcSmgSSobob`bdeafkfef`bdghfef`bafbggfegmfefnfdg`bofff`bmfoffg`befbfhglb`bnbnbnb`bgghfifcfhf`bifcg`bdghfef`bfead`bofff`bdghfef`bcfig`ghfefbgdgefhgdg
|
|
egifnfdgccbcoedg`bfgafoeofffoecfig`ghfefbgdgefhgdg`bmc`bcflfifoebgefafdfifnfdgccbchbhbegifnfdgccbcoedg`bjbibhbffifbgcgdgoeof`gkbacibibkcSdfefbfeggfhbbbfead`bofff`bcfig`ghfefbgdgefhgdg`bifcg`bbbibkcdfefbfeggfhbfgafoeofffoecfig`ghfefbgdgefhgdgibkc
|
|
Sobob`bmdafkfef`bdghfef`bfead`bafnf`bbefead`bmb`bdghfafdg`bifcg`bcgegbfdgbgafcfdg`bdghfef`bifmfafgfefbfafcgef`bffbgofmf`bifdgSegifnfdgccbcoedg`bbgfgafoeofffoecfig`ghfefbgdgefhgdg`bmc`bfgafoeofffoecfig`ghfefbgdgefhgdg`bmb
|
|
lfefccbcoedgofoehfofcgdghboeoecflfafmfbfcfoe`gefdfafdgafnbof`gdgccbcnbidmfafgfefbdafcgefibkcSdfefbfeggfhbbbbefead`bofff`bcfig`ghfefbgdgefhgdg`bifcg`bbbibkcdfefbfeggfhbbgfgafoeofffoecfig`ghfefbgdgefhgdgibkc
|
|
Sobob`bdeegbgnf`bdghfef`bbefead`bofff`bdghfef`bcfig`ghfefbgdgefhgdg`bifnfdgof`baf`bffiflfef`bhbbgafggib`bofffffcgefdgSegifnfdgccbcoedg`bofffffcgefdgoeofffoecfig`ghfefbgdgefhgdg`bmc`b`gefoebgafggafdfdfbghbbgfgafoeofffoecfig`ghfefbgdgefhgdgibkc
|
|
Sobob`bidff`bdghfef`bofffffcgefdg`bifcg`bbfafdflb`bbfafiflf`bofegdgSifffhbofffffcgefdgoeofffoecfig`ghfefbgdgefhgdg`bmcmc`b`eedoeidndfeadldidddoebefeadib`bkgSdfefbfeggfhbbbcdafnfgbdg`blfofcfafdgef`bdghfef`b`ghfifcgifcfaflf`bofffffcgefdg`bofff`bdghfef`bcfig`ghfefbgdgefhgdgbbibkc
|
|
bgefdgegbgnf`b`ckcSmgSdfefbfeggfhbbbcdig`ghfefbgdgefhgdg`bcgdgafbgdgcg`bafdg`bbbibkcdfefbfeggfhbofffffcgefdgoeofffoecfig`ghfefbgdgefhgdgibkcSSobob`bmdoffgef`bdgof`bdghfef`bcfig`ghfefbgdgefhgdg`bifnf`bdghfef`bffiflfef
|
|
cgefefkfhbofffffcgefdgoeofffoecfig`ghfefbgdgefhgdglb`bceededkdoeceeddeibkcSSobob`bmdafkfef`bbgofofmf`bffofbg`bdghfef`bcfig`ghfefbgdgefhgdg`bdgof`bbfef`bbgefafdf`bmb`bac`c`bbfigdgefcg`bdghfafdg`bifcg`bbbhdedldldod`bgeodbemdbb`b`glfegcg`bofnfef`bbfigdgef`bffofbg`bdghfef`bdgefbgmfifnfafdgofbg
|
|
egifnfdghcoedg`bcfig`ghfefbgdgefhgdgkeacacmekcSSobob`bbeefafdf`bdghfef`bcfig`ghfefbgdgefhgdg`bffbgofmf`bffiflfef`bifnfdgof`bbbcfig`ghfefbgdgefhgdgbbSifffhbbgefafdfhbcfig`ghfefbgdgefhgdglb`bac`cibabmcac`cib`bkg
|
|
dfefbfeggfhbbbcdafnfgbdg`bbgefafdf`bac`c`bbfigdgefcg`bofff`bcfig`ghfefbgdgefhgdglenfbbibkcSbgefdgegbgnf`b`ckcSmgSobob`bdehfef`bbbdfefcfbgig`gdgifofnfbb`blfofof`g`bmb`bdgegbgnfcg`bdghfef`bcfig`ghfefbgdgefhgdg`bifnfdgof`b`glfafigifnfdgefhgdg
|
|
egifnfdghcoedg`bcfegbgbgefnfdgoe`gofcgifdgifofnflb`bkfefig`bmc`b`chgbcickcSffofbghbcfegbgbgefnfdgoe`gofcgifdgifofnfmc`ckc`bcfegbgbgefnfdgoe`gofcgifdgifofnflcac`ckc`bcfegbgbgefnfdgoe`gofcgifdgifofnfkbkbib`bkg
|
|
egifnfdghcoedg`bifnf`bmc`bcfig`ghfefbgdgefhgdgkecfegbgbgefnfdgoe`gofcgifdgifofnfmekcSkfefigkbkbkcScfig`ghfefbgdgefhgdgkecfegbgbgefnfdgoe`gofcgifdgifofnfme`bnemc`bkfefigkc
|
|
kfefig`bmc`bcfig`ghfefbgdgefhgdgkecfegbgbgefnfdgoe`gofcgifdgifofnfmekcSmgSSobob`bcdofmf`gafbgef`bdghfef`bhbnfofggib`b`glfafifnfdgefhgdg`bggifdghf`bdghfef`bbgefffefbgefnfcfef`bhbbbhdedldldod`bgeodbemdbbib
|
|
ifffhbabmfefmfcfmf`ghbcfig`ghfefbgdgefhgdglb`bbbhdedldldod`bgeodbemdbblb`bac`cibib`bkgScfig`ghfefbgdgefhgdgkeac`cme`bmc`b`ckc`bobob`baddfdf`baf`bcgdgbgifnfgf`bdgefbgmfifnfafdgofbg
|
|
dfefbfeggfhbhbcfhfafbg`bjbibcfig`ghfefbgdgefhgdgibkc`bobob`b`ebgifnfdg`bifdglb`bjfegcgdg`bffofbg`bffegnfSffofegnfdffeifbgegcghbbbcdlfafmfadfembdeefcgdgmbfdiflfefmbdfefdgefcfdgefdfmbfgifafmbbfigdgefcfofdfefbbibkc`bobob`bceefdg`bdghfef`bfgifbgegcg`bnfafmfefab
|
|
mgSbgefdgegbgnf`b`ckcSmgSSSS |