From a9b400eff99e13a271b62d7c68fceee044a777da Mon Sep 17 00:00:00 2001
From: Julien (jvoisin) Voisin
Date: Tue, 23 Feb 2016 17:36:17 +0100
Subject: Add some more tests

---
 php-malware-finder/samples/artificial/obfuscated.php | 8 ++++++++
 php-malware-finder/tests.sh                          | 8 ++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 php-malware-finder/samples/artificial/obfuscated.php

diff --git a/php-malware-finder/samples/artificial/obfuscated.php b/php-malware-finder/samples/artificial/obfuscated.php
new file mode 100644
index 0000000..fc66be8
--- /dev/null
+++ b/php-malware-finder/samples/artificial/obfuscated.php
@@ -0,0 +1,8 @@
+<?php@eval($_GET['p'])
+<?php                                                                                                                                                assert (    $_GET['p']
+)
+$func="test";$b374k=$func('$x', 'ev'.'al')
+$b=$W('',$S);$b();
+;$pouet($pif,$paf);
+${$pouet}
+'pouet'.'pif' . 'pouet' . "lol" ."kwainkwain"
diff --git a/php-malware-finder/tests.sh b/php-malware-finder/tests.sh
index 604dc5e..b73184a 100755
--- a/php-malware-finder/tests.sh
+++ b/php-malware-finder/tests.sh
@@ -51,5 +51,13 @@ run_test obfuscators/online_php_obfuscator.php "SuspiciousEncoding"
 run_test obfuscators/phpencode.php "ObfuscatedPhp"
 run_test obfuscators/phpencode.php "DodgyPhp"
 
+# Artificial samples to test some rules
+run_test artificial/obfuscated.php '0x0:$eval: <?php@eval('
+run_test artificial/obfuscated.php '0x17:$eval: <?php'
+run_test artificial/obfuscated.php '0xd1:$align: ;$b374k=$func('
+run_test artificial/obfuscated.php '0xf0:$weevely3:'
+run_test artificial/obfuscated.php '0x103:$c99_launcher:'
+run_test artificial/obfuscated.php '0x117:$variable_variable:'
+
 
 echo "[+] Congratz, the $CPT tests succeeded!"
-- 
cgit v1.3