mirror of
https://github.com/lukaszraczylo/go-obfuscation.git
synced 2026-10-12 05:32:33 +00:00
lukaszraczylo
b6c3bacd23
Bug fixes: - pclntab/rtcorrupt_linux.go: remove duplicate mprotectRW/mprotectRO that broke GOOS=linux builds (they're defined in rtcorrupt_unsafe.go for darwin+linux). - pclntab/pclntab.go: readUint now guards against negative offset (previously panicked via slice out-of-range). - integrity/integrity.go: SetExpectedHashHex now validates length 64 up-front and reports byte index on parse error; added ClearExpectedHash for runtime toggling and test isolation. - transform/mba.go: mbaApplyBinOp used strings.Index on first match instead of the current match; replaced with FindAllStringSubmatchIndex + two-pass replacement. - transform/transform.go: removed duplicate unconditional SplitLongStrings call. New transform passes (CLI flags + Config fields + pipeline wiring): - splice, constblind, mba, fakesigs, funcsplit, bbreorder — all default true. Cleanup: - strenc/keyderive.go: removed unused DeriveFromBinary + buildSeed. - transform/transform.go: removed unused trimFirstParen. - antidebug_hook_darwin.go: modernized readAddr to unsafe.Slice with noescape pattern (vet-safe). Tests (10 packages, 116 tests, all green): - internal/transform: 28 tests covering every pipeline stage. - pkg/strenc: 7 tests for key derivation + XOR stream. - pkg/stringcrypt: 7 tests for CFB round-trip + tamper detection. - pkg/pageman: 14 tests for alignment + mprotect guards. - pkg/integrity: 14 tests including ClearExpectedHash teardown. - pkg/pclntab: 12 tests including readUint negative-offset guard. - pkg/antisandbox: 6 tests for hostname/MAC lists + Check delegation. - pkg/antiemul: 6 tests (1 skipped on non-Linux) for no-panic + timing. Tooling: - Makefile: added test, verify, lint, fmt, vet targets. vet uses -unsafeptr=false (only legitimate uintptr→pointer is the darwin antidebug hook). fmt skips build/ (generated). - README.md: test coverage table + Makefile target reference.
50 lines
1.2 KiB
Go
50 lines
1.2 KiB
Go
package antisandbox
|
|
|
|
import "testing"
|
|
|
|
func TestSuspiciousHostnamesList(t *testing.T) {
|
|
if len(suspiciousHostnames) == 0 {
|
|
t.Fatal("suspiciousHostnames should be populated")
|
|
}
|
|
for _, h := range suspiciousHostnames {
|
|
if h == "" {
|
|
t.Error("empty entry in suspiciousHostnames")
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestVMMACPrefixesList(t *testing.T) {
|
|
if len(vmMACPrefixes) == 0 {
|
|
t.Fatal("vmMACPrefixes should be populated")
|
|
}
|
|
for _, p := range vmMACPrefixes {
|
|
if len(p) < 8 {
|
|
t.Errorf("MAC prefix too short: %q", p)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCheckDelegatesToCheckNetwork(t *testing.T) {
|
|
// The Check function should return whatever CheckNetwork returns.
|
|
// We can't easily mock net.Interfaces, so just call it and assert no panic.
|
|
_ = Check()
|
|
}
|
|
|
|
func TestCheckNetworkDoesNotPanic(t *testing.T) {
|
|
_ = CheckNetwork()
|
|
}
|
|
|
|
func TestCheckHostnameAgainstCurrentHost(t *testing.T) {
|
|
// The current hostname should not match any of the suspicious patterns,
|
|
// unless the test is somehow running in a sandbox.
|
|
got := checkHostname()
|
|
if got {
|
|
t.Log("current hostname flagged as suspicious (running in a sandbox-like env?)")
|
|
}
|
|
}
|
|
|
|
func TestCheckARPDoesNotPanicOnOtherOS(t *testing.T) {
|
|
// On non-Linux platforms the /proc/net/arp read fails and returns false.
|
|
_ = checkARP()
|
|
}
|