From bc486df250e107a8158f5b9b0495d2ddc1fb7d31 Mon Sep 17 00:00:00 2001
From: zhaolei <12153398@qq.com>
Date: Thu, 29 Oct 2026 17:31:53 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20L0-004/L1-008=20expected=5Fverdict=20pas?=
 =?UTF-8?q?s=E2=86=92suspicious?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

L0-004_pdf_normal.pdf (14字节):
  只有 %PDF-1.4 头和 %%EOF 尾, 缺 xref/trailer/catalog
  引擎报 MalformedStructure/PdfParseFailed 是对的
  expected_rules 本来就写了这两个, expected_verdict 写成 pass 矛盾
  → pass → suspicious

L1-008_L0-005_pe_clean.exe (926字节):
  e_lfanew=0x80 但 PE\\0\\0 实际在 0x7e (差2字节)
  pefile 报 Invalid NT Headers signature, PeParseFailed 是对的
  expected_verdict 写成 pass 不对
  → pass → suspicious

两个样本都是'测试畸形检测'用的负样本, 不是'干净文件对照'
引擎行为正确, 是 expected_verdict 本身写错了
---
 tests/samples/index.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/samples/index.json b/tests/samples/index.json
index cbed4c6..fac3c82 100644
--- a/tests/samples/index.json
+++ b/tests/samples/index.json
@@ -43,7 +43,7 @@
       "filename": "L0-004_pdf_normal.pdf",
       "case_id": "L0-004",
       "category": "L0",
-      "expected_verdict": "pass",
+      "expected_verdict": "suspicious",
       "expected_rules": [
         "MalformedStructure",
         "PdfParseFailed"
@@ -55,7 +55,7 @@
       "filename": "L0-005_pe_clean.exe",
       "case_id": "L1-008",
       "category": "L1",
-      "expected_verdict": "pass",
+      "expected_verdict": "suspicious",
       "expected_rules": [
         "DangerousExecutableExtension",
         "PeParseFailed"