nx_pamp_test.nx source

1// nx_pamp_test.nx -- smoke for nx_pamp. 2 3import "nx_syscalls.nx" 4import "nx_pamp.nx" 5 6func main() -> i64 { 7 // 1: kind enum sealed 8 if NX_PAMP_N_KINDS != 9 { return 1 } 9 if nx_pamp_kind_is_valid(NX_PAMP_TROJAN_SOURCE_HOMOGLYPH) != 1 { return 2 } 10 if nx_pamp_kind_is_valid(NX_PAMP_DECOY_INVALID_METHYL) != 1 { return 3 } 11 if nx_pamp_kind_is_valid(-1) != 0 { return 4 } 12 if nx_pamp_kind_is_valid(9) != 0 { return 5 } 13 14 let hit: *NxPampHit = (sys_mmap(32)) as *NxPampHit 15 16 // 2: clean ASCII passes 17 let clean: *u8 = (sys_mmap(32)) as *u8 18 var i: nx_size = 0 19 while i < 16 { 20 clean[i] = (65 + i) as u8 // 'A'..'P' 21 i = i + 1 22 } 23 if nx_pamp_scan(clean, 16, hit) != NX_PAMP_OK { return 6 } 24 if hit.kind != NX_PAMP_NONE { return 7 } 25 26 // 3: NOP-sled detected 27 let nop: *u8 = (sys_mmap(64)) as *u8 28 var j: nx_size = 0 29 while j < 32 { 30 nop[j] = 144 as u8 // 0x90 31 j = j + 1 32 } 33 if nx_pamp_scan(nop, 32, hit) != NX_PAMP_DETECTED { return 8 } 34 if hit.kind != NX_PAMP_SHELLCODE_NOPSLED { return 9 } 35 if hit.length < 16 { return 10 } 36 if hit.confidence < 800 { return 11 } 37 38 // 4: short NOP run NOT detected (below threshold) 39 let nop_short: *u8 = (sys_mmap(16)) as *u8 40 var k: nx_size = 0 41 while k < 8 { 42 nop_short[k] = 144 as u8 43 k = k + 1 44 } 45 if nx_pamp_scan(nop_short, 8, hit) != NX_PAMP_OK { return 12 } 46 47 // 5: Trojan-Source homoglyph (Latin 'a' + Cyrillic 'а') 48 // Cyrillic 'а' (U+0430) is UTF-8 bytes [0xD0, 0xB0] 49 let homo: *u8 = (sys_mmap(16)) as *u8 50 homo[0] = 65 as u8 // 'A' ascii 51 homo[1] = 66 as u8 // 'B' 52 homo[2] = 67 as u8 // 'C' 53 homo[3] = 208 as u8 // 0xD0 54 homo[4] = 176 as u8 // 0xB0 -- Cyrillic 'а' 55 homo[5] = 68 as u8 // 'D' 56 if nx_pamp_scan(homo, 6, hit) != NX_PAMP_DETECTED { return 13 } 57 if hit.kind != NX_PAMP_TROJAN_SOURCE_HOMOGLYPH { return 14 } 58 if hit.confidence < 900 { return 15 } 59 60 // 6: entropy anomaly (uniform-looking high-entropy region) 61 let unif: *u8 = (sys_mmap(512)) as *u8 62 var u: nx_size = 0 63 while u < 512 { 64 unif[u] = (u & 255) as u8 // perfectly uniform byte spread 65 u = u + 1 66 } 67 if nx_pamp_scan(unif, 512, hit) != NX_PAMP_DETECTED { return 16 } 68 if hit.kind != NX_PAMP_ENTROPY_ANOMALY { return 17 } 69 70 // 7: empty buffer rejected 71 if nx_pamp_scan(unif, 0, hit) != NX_PAMP_ERR_BAD_BUF { return 18 } 72 73 // 8: null buffer rejected 74 let nullb: *u8 = (0 as i64) as *u8 75 if nx_pamp_scan(nullb, 16, hit) != NX_PAMP_ERR_BAD_BUF { return 19 } 76 77 return 0 78}