[Tests] Floss ELF support

[c-urly]

Including Linux for testing ELF.

$ pytest -v tests/data/src/ ============================================================================ test session starts ============================================================================platform linux -- Python 3.9.2, pytest-7.4.4, pluggy-1.3.0 -- /usr/bin/python3 cachedir: .pytest_cache rootdir: /mnt/e/Github/flare-floss collected 64 items tests/data/src/decode-base64/test.yml::test-decode-base64::Linux::32bit PASSED [ 1%] tests/data/src/decode-base64/test.yml::test-decode-base64::Windows::32bit PASSED [ 3%] tests/data/src/decode-base64/test.yml::test-decode-base64::Windows::64bit PASSED [ 4%] tests/data/src/decode-from-global/test.yml::test-decode-from-global::Linux::32bit PASSED [ 6%] tests/data/src/decode-from-global/test.yml::test-decode-from-global::Windows::32bit PASSED [ 7%] tests/data/src/decode-from-global/test.yml::test-decode-from-global::Windows::64bit PASSED [ 9%] tests/data/src/decode-from-heap/test.yml::test-decode-from-heap::Linux::32bit PASSED [ 10%] tests/data/src/decode-from-heap/test.yml::test-decode-from-heap::Windows::32bit PASSED [ 12%] tests/data/src/decode-from-heap/test.yml::test-decode-from-heap::Windows::64bit PASSED [ 14%] tests/data/src/decode-from-stack/test.yml::test-decode-from-stack::Linux::32bit PASSED [ 15%] tests/data/src/decode-from-stack/test.yml::test-decode-from-stack::Windows::32bit PASSED [ 17%] tests/data/src/decode-from-stack/test.yml::test-decode-from-stack::Windows::64bit PASSED [ 18%] tests/data/src/decode-global-stackstrings/test.yml::test-decode-global-stackstrings::Linux::32bit XFAIL (unsupported test case (known issue)) [ 20%] tests/data/src/decode-global-stackstrings/test.yml::test-decode-global-stackstrings::Windows::32bit XFAIL (unsupported test case (known issue)) [ 21%] tests/data/src/decode-global-stackstrings/test.yml::test-decode-global-stackstrings::Windows::64bit XFAIL (unsupported test case (known issue)) [ 23%] tests/data/src/decode-in-place/test.yml::test-decode-in-place::Linux::32bit PASSED [ 25%] tests/data/src/decode-in-place/test.yml::test-decode-in-place::Windows::32bit PASSED [ 26%] tests/data/src/decode-in-place/test.yml::test-decode-in-place::Windows::64bit PASSED [ 28%] tests/data/src/decode-local-stackstrings/test.yml::test-decode-local-stackstrings::Linux::32bit PASSED [ 29%] tests/data/src/decode-local-stackstrings/test.yml::test-decode-local-stackstrings::Windows::32bit PASSED [ 31%] tests/data/src/decode-local-stackstrings/test.yml::test-decode-local-stackstrings::Windows::64bit PASSED [ 32%] tests/data/src/decode-rc4/test.yml::test-decode-rc4::Linux::32bit PASSED [ 34%] tests/data/src/decode-rc4/test.yml::test-decode-rc4::Windows::32bit PASSED [ 35%] tests/data/src/decode-rc4/test.yml::test-decode-rc4::Windows::64bit PASSED [ 37%] tests/data/src/decode-reencode-string/test.yml::test-decode-reencode-string::Linux::32bit PASSED [ 39%] tests/data/src/decode-reencode-string/test.yml::test-decode-reencode-string::Windows::32bit PASSED [ 40%] tests/data/src/decode-reencode-string/test.yml::test-decode-reencode-string::Windows::64bit PASSED [ 42%] tests/data/src/decode-single-byte-xor/test.yml::test-decode-single-byte-xor::Linux::32bit PASSED [ 43%] tests/data/src/decode-single-byte-xor/test.yml::test-decode-single-byte-xor::Windows::32bit PASSED [ 45%] tests/data/src/decode-single-byte-xor/test.yml::test-decode-single-byte-xor::Windows::64bit PASSED [ 46%] tests/data/src/decode-split-stackstrings/test.yml::test-decode-split-stackstrings::Linux::32bit PASSED [ 48%] tests/data/src/decode-split-stackstrings/test.yml::test-decode-split-stackstrings::Windows::32bit PASSED [ 50%] tests/data/src/decode-split-stackstrings/test.yml::test-decode-split-stackstrings::Windows::64bit PASSED [ 51%] tests/data/src/decode-stackstrings-move-to-global/test.yml::test-decode-stackstrings-move-to-global::Linux::32bit PASSED [ 53%] tests/data/src/decode-stackstrings-move-to-global/test.yml::test-decode-stackstrings-move-to-global::Windows::32bit PASSED [ 54%] tests/data/src/decode-stackstrings-move-to-global/test.yml::test-decode-stackstrings-move-to-global::Windows::64bit PASSED [ 56%] tests/data/src/decode-string-with-header/test.yml::test-decode-string-with-header::Linux::32bit PASSED [ 57%] tests/data/src/decode-string-with-header/test.yml::test-decode-string-with-header::Windows::32bit PASSED [ 59%] tests/data/src/decode-string-with-header/test.yml::test-decode-string-with-header::Windows::64bit PASSED [ 60%] tests/data/src/decode-substitution-cipher/test.yml::test-decode-substitution-cipher::Linux::32bit PASSED [ 62%] tests/data/src/decode-substitution-cipher/test.yml::test-decode-substitution-cipher::Windows::32bit PASSED [ 64%] tests/data/src/decode-substitution-cipher/test.yml::test-decode-substitution-cipher::Windows::64bit PASSED [ 65%] tests/data/src/decode-tightstring/test.yml::test-decode-tightstring::Linux::32bit PASSED [ 67%] tests/data/src/decode-tightstring/test.yml::test-decode-tightstring::Windows::32bit PASSED [ 68%] tests/data/src/decode-tightstring/test.yml::test-decode-tightstring::Windows::64bit PASSED [ 70%] tests/data/src/decode-to-global/test.yml::test-decode-to-global::Linux::32bit PASSED [ 71%] tests/data/src/decode-to-global/test.yml::test-decode-to-global::Windows::32bit PASSED [ 73%] tests/data/src/decode-to-global/test.yml::test-decode-to-global::Windows::64bit PASSED [ 75%] tests/data/src/decode-to-heap/test.yml::test-decode-to-heap::Linux::32bit PASSED [ 76%] tests/data/src/decode-to-heap/test.yml::test-decode-to-heap::Windows::32bit PASSED [ 78%] tests/data/src/decode-to-heap/test.yml::test-decode-to-heap::Windows::64bit PASSED [ 79%] tests/data/src/decode-to-output-buf/test.yml::test-decode-to-output-buf::Linux::32bit PASSED [ 81%] tests/data/src/decode-to-output-buf/test.yml::test-decode-to-output-buf::Windows::32bit PASSED [ 82%] tests/data/src/decode-to-output-buf/test.yml::test-decode-to-output-buf::Windows::64bit PASSED [ 84%] tests/data/src/decode-to-stack/test.yml::test-decode-to-stack::Linux::32bit PASSED [ 85%] tests/data/src/decode-to-stack/test.yml::test-decode-to-stack::Windows::32bit PASSED [ 87%] tests/data/src/decode-to-stack/test.yml::test-decode-to-stack::Windows::64bit PASSED [ 89%] tests/data/src/decode-to-stack-rep-mov/test.yml::test-decode-to-stack-rep-mov::Linux::32bit PASSED [ 90%] tests/data/src/decode-to-stack-rep-mov/test.yml::test-decode-to-stack-rep-mov::Windows::32bit PASSED [ 92%] tests/data/src/decode-to-stack-rep-mov/test.yml::test-decode-to-stack-rep-mov::Windows::64bit PASSED [ 93%] tests/data/src/decode-wrapped-decoder/test.yml::test-decode-wrapped-decoder::Linux::32bit XFAIL (unsupported test case (known issue)) [ 95%] tests/data/src/decode-wrapped-decoder/test.yml::test-decode-wrapped-decoder::Windows::32bit XFAIL (unsupported test case (known issue)) [ 96%] tests/data/src/decode-wrapped-decoder/test.yml::test-decode-wrapped-decoder::Windows::64bit XFAIL (unsupported test case (known issue)) [ 98%] tests/data/src/shellcode-stackstrings/test.yml::shellcode-stackstrings::Windows::x86 PASSED [100%] ================================================================= 58 passed, 6 xfailed in 152.74s (0:02:32) =================================================================

[mr-tz]

Thanks, unfortunately we cannot merge this into master.
Instead we have to create a new branch here, e.g., elf-tests and then point mandiant/flare-floss#932 to use that branch (for testing in CI).

[c-urly]

Thanks, unfortunately we cannot merge this into master. Instead we have to create a new branch here, e.g., elf-tests and then point mandiant/flare-floss#932 to use that branch (for testing in CI).

Hi, Can you help me with this? How to create a new branch here.

[mr-tz]

I've created the branch https://github.com/mandiant/flare-floss-testfiles/tree/elf-tests. Can you point this PR to this branch?

[mr-tz]

FLOSS now has a branch https://github.com/mandiant/flare-floss/tree/elf-support, let's do the ELF support dev in there.

[c-urly]

Sure will do that today.

[mr-tz]

superseded by #18