zhaolei/MeshSate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: L0-004/L1-008 expected_verdict pass→suspicious

Browse Source 
L0-004_pdf_normal.pdf (14字节):
  只有 %PDF-1.4 头和 %%EOF 尾, 缺 xref/trailer/catalog
  引擎报 MalformedStructure/PdfParseFailed 是对的
  expected_rules 本来就写了这两个, expected_verdict 写成 pass 矛盾
  → pass → suspicious

L1-008_L0-005_pe_clean.exe (926字节):
  e_lfanew=0x80 但 PE\\0\\0 实际在 0x7e (差2字节)
  pefile 报 Invalid NT Headers signature, PeParseFailed 是对的
  expected_verdict 写成 pass 不对
  → pass → suspicious

两个样本都是'测试畸形检测'用的负样本, 不是'干净文件对照'
引擎行为正确, 是 expected_verdict 本身写错了
This commit is contained in:
zhaolei
2026-10-29 17:31:53 +08:00
parent 9834930299
commit bc486df250
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/samples/index.json
View File

@@ -43,7 +43,7 @@
"filename": "L0-004_pdf_normal.pdf", "filename": "L0-004_pdf_normal.pdf",
"case_id": "L0-004", "case_id": "L0-004",
"category": "L0", "category": "L0",
"expected_verdict": "pass", "expected_verdict": "suspicious",
"expected_rules": [ "expected_rules": [
"MalformedStructure", "MalformedStructure",
"PdfParseFailed" "PdfParseFailed"
@@ -55,7 +55,7 @@
"filename": "L0-005_pe_clean.exe", "filename": "L0-005_pe_clean.exe",
"case_id": "L1-008", "case_id": "L1-008",
"category": "L1", "category": "L1",
"expected_verdict": "pass", "expected_verdict": "suspicious",
"expected_rules": [ "expected_rules": [
"DangerousExecutableExtension", "DangerousExecutableExtension",
"PeParseFailed" "PeParseFailed"