Skip to content

test: add comprehensive tests for API extraction helpers - #2942

Closed
231B145-JUET wants to merge 1 commit into
mandiant:masterfrom
231B145-JUET:fix-1899-api-extraction-tests
Closed

test: add comprehensive tests for API extraction helpers#2942
231B145-JUET wants to merge 1 commit into
mandiant:masterfrom
231B145-JUET:fix-1899-api-extraction-tests

Conversation

@231B145-JUET

Copy link
Copy Markdown

Resolves #1899.

Added comprehensive test coverage for all helper functions in capa/features/extractors/helpers.py, including:

  • is_aw_function edge cases
  • is_ordinal edge cases
  • generate_symbols handling of .dll, .drv, .so, case normalization, and empty DLL names
  • reformat_forwarded_export_name
  • xor_static and twos_complement
  • carve_pe

This provides the requested test coverage for API pattern variants before refactoring.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add bug fixes, new features, breaking changes and anything else you think is worthwhile mentioning to the master (unreleased) section of CHANGELOG.md. If no CHANGELOG update is needed add the following to the PR description: [x] No CHANGELOG update needed

@gemini-code-assist

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the test suite for the API extraction helper functions within capa/features/extractors/helpers.py. By introducing comprehensive and detailed test cases for functions like is_aw_function, is_ordinal, generate_symbols, reformat_forwarded_export_name, xor_static, twos_complement, and carve_pe, the changes ensure the robustness and correctness of these critical components. This expanded coverage addresses various edge cases and scenarios, providing a more reliable foundation for future development and refactoring of API pattern variants.

Highlights

  • Expanded Test Coverage for API Extraction Helpers: Comprehensive tests were added for is_aw_function, is_ordinal, generate_symbols, reformat_forwarded_export_name, xor_static, twos_complement, and carve_pe.
  • Improved generate_symbols Testing: New tests cover DLL extension stripping (e.g., .dll, .drv, .so), DLL name case normalization, and handling of empty DLL names.
  • Edge Case Validation: Specific tests were introduced to validate edge cases for is_aw_function (e.g., single characters, lowercase suffixes) and is_ordinal (e.g., hash only, no hash prefix).
  • Forwarded Export Name Formatting: Tests for reformat_forwarded_export_name now ensure correct case normalization and handling of full paths.
  • Utility Function Robustness: xor_static and twos_complement functions received tests for various inputs, including zero XOR, inversion, roundtrip, and different bit lengths.
  • PE Carving Validation: carve_pe tests now cover empty buffers, absence of PE headers, and truncated MZ headers.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request does an excellent job of adding comprehensive tests for the API extraction helper functions. The new tests are well-structured into classes and cover many edge cases. I have a couple of suggestions to make the test suite even more robust, particularly for reformat_forwarded_export_name and carve_pe.

Comment thread tests/test_helpers.py
def test_api_ms_dll(self):
"""DLL names with dashes and multiple segments should be lowercased correctly."""
result = helpers.reformat_forwarded_export_name(
"api-ms-win-core-synch-l1-1-0.SleepEx"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The current test for api-ms-dll names uses an already lowercase DLL name. To properly test that the function correctly lowercases DLL names with dashes, it would be better to use an uppercase DLL name in the test case. This will make the test more robust.

Suggested change
"api-ms-win-core-synch-l1-1-0.SleepEx"
"API-MS-WIN-CORE-SYNCH-L1-1-0.SleepEx"

Comment thread tests/test_helpers.py
Comment on lines +310 to +323
class TestCarvePe:
"""test the carve_pe helper for finding embedded PE files."""

def test_empty_buffer(self):
"""Empty buffer should yield no results."""
assert list(helpers.carve_pe(b"")) == []

def test_no_pe(self):
"""Buffer without MZ header should yield no results."""
assert list(helpers.carve_pe(b"\x00" * 1024)) == []

def test_truncated_mz(self):
"""Buffer with MZ but too short for e_lfanew should yield no results."""
assert list(helpers.carve_pe(b"MZ" + b"\x00" * 10)) == []

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The test suite for carve_pe currently only includes negative test cases (e.g., empty buffer, no PE header). To ensure the function works correctly, it's important to add positive test cases that verify it can successfully identify embedded PE files.

Consider adding tests for:

  • A buffer containing a simple, valid PE file.
  • A buffer containing a XOR-encoded PE file.

This would make the test coverage for this complex function truly "comprehensive" as intended by the PR.

@williballenthin williballenthin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this code style is not consistent with the rest of the project and the code obviously AI generated. while the latter doesn't bother me, the former does, because it doesn't demonstrate much effort on behalf of the author. closing the PR to avoid distracting other maintainers from their work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add tests (and refactor) API extraction and symbol generation

2 participants