From b455e7e2ec34acd3733c10f4542350e136fc851f Mon Sep 17 00:00:00 2001
From: "Victor M. Alvarez" <vmalvarez@virustotal.com>
Date: Sat, 3 Feb 2024 12:47:00 +0100
Subject: [PATCH] tests: add test cases covering more Mach-O architectures

---
 ...3c8beebeb768e712bd3b754b5cd3e151356.in.zip | Bin 0 -> 4202 bytes
 ...1543c8beebeb768e712bd3b754b5cd3e151356.out |  81 +++++
 ...79cb0e7394c7b5065f74b7ce8c52ace75f1.in.zip | Bin 0 -> 22453 bytes
 ...18d79cb0e7394c7b5065f74b7ce8c52ace75f1.out | 338 ++++++++++++++++++
 4 files changed, 419 insertions(+)
 create mode 100644 yara-x/src/modules/macho/tests/testdata/8962a76d0aeaee3326cf840de11543c8beebeb768e712bd3b754b5cd3e151356.in.zip
 create mode 100644 yara-x/src/modules/macho/tests/testdata/8962a76d0aeaee3326cf840de11543c8beebeb768e712bd3b754b5cd3e151356.out
 create mode 100644 yara-x/src/modules/macho/tests/testdata/a1da3d22c5ec85143faf5f69fb18d79cb0e7394c7b5065f74b7ce8c52ace75f1.in.zip
 create mode 100644 yara-x/src/modules/macho/tests/testdata/a1da3d22c5ec85143faf5f69fb18d79cb0e7394c7b5065f74b7ce8c52ace75f1.out

diff --git a/yara-x/src/modules/macho/tests/testdata/8962a76d0aeaee3326cf840de11543c8beebeb768e712bd3b754b5cd3e151356.in.zip b/yara-x/src/modules/macho/tests/testdata/8962a76d0aeaee3326cf840de11543c8beebeb768e712bd3b754b5cd3e151356.in.zip
new file mode 100644
index 0000000000000000000000000000000000000000..28f93ac82ef16137c75ffdcc8101c98ad486a242
GIT binary patch
literal 4202
zcmeHKdr(u^84rY)MPOA#c?deFRFNpJgt&xk8(ncJ4@CtfyaEv|QN#dCc*W=pxD}I9
zsqPR+>dL}GD1lPMK!D3*pd*j#sxc@JBN=i<ihwsfvXZ119~Gtwai-J1dhcY;x##|J
z?svZPeZTK_g8a}1mM9bCcA}6%QSUC(S`><e+KlqTW8I>0*w{VM)MzTz-Q5ivbJELW
zPb}5d)zia0#*0FwQm7Oh){BaBb)&?(Q*fRh6wjDgcdDzWtGg!_bNcMjBW5V$hRsdX
z_rK&+Q<R>8L4!WZAUIMFb#-v;{BVcWSI@MiFT__KZU}!B_}jq=t?zH{N3gg2F4SvB
z$4t(tb{nHM%$P9oP9Wz|U5XOxJ!~3WSn3s~)iyT=cx!%9+-a}t463fJHS}pNyz%-<
zEs>b*c3t$ao}dl<ksrzD0F1dLn@FGj9ALyTi=dY6ov+_V`(r=DMUY>g4?t%Ge(JXM
z12=pCczX2pT{(=$v{p8x>@&L-vHLtG1`|v;ESnwx+?Zsec>Bl6{mcr6i#(AxYnMv=
z_UnUFJ<sO;Uf5mW&^8-<lIT!<dk4tC&<h@w`NPh<>%h3wOeNPSjAq94RVT(a3eJ$~
zrS=;#+ub@iVQCF4m)qV=&*x&<VVM|Vz8jk`DawP=h>@g<TL~<9!e8UjdQ|-KYIVk*
z!piUyC9W(mn^&EI*b$)su7$$A1rW1o222}D3I7h;F#>Oo3|QB2R-N3IMckTy;JBZ2
zI-@et0i7U~h;c2EMd{9-nv&etLfgZ~AIwv7{!A4syJr~6KbUfM$+ro;x~6h0@3cn>
zs?{ebndwzG|K?(k>(E4pH1g9b@R_9`Pre1GewLMm-z3vM@!;5c|Dzb>fWp!u7j7qH
zMsDusGlTCd2hB}WHD`0IE7FXF`XQ6s&*@F*$5k;h0%RoFngIiQpd129Zt*)I1i)?H
zX;JlJ0V?3Nl*fIli?2EubBY6e8nAQ*bK1-Co8zpbV3fo?bb9qM!lh-qc6|dZ(iQ#%
zA8pWd%3j^Rg0B(<W?K=9LEUXif$t613iq#U&s&38Jv`eJV(*6X<s7qU-T11<)+Da}
zvVL3w7iE$JpW&ljj8jv+a+2=m@65JJXmI$re|8gY$W@VkQ2e2;pYJjn`|ow&jhxs5
zD9I<8rn1Yr(_5NU6eySPh5Y;F|5QbMGY0MNbs4<0?o2cG+M}x>Ti7)aG{Pr7=5(pL
zm969T+0gWW6oBjHyH0;ID^Zh4<x(j5im)bE5O+It!bL+qRRJ;sPYiDxxx|Y<BigNI
z)bnG)aY>hL?Kq$`8=ASDn|5ZZo(aYeOS-TTIMq-ybmZRs{-fh=gjsqS#85weHC;3s
zG4@5B&xBCgZfgy-W<M;A-|0M!=L@Bk2@c&swKdReLKBnb%6d=^IH#^n)dTfG*?!q7
z@vpisAL=*2$iii-vrGzs9Ki9;D(?#o0AW(1!3_-G{0m3lLAG@gU1)gnhl-UpuxUzd
zFl>94q+4twv1DxT4<4|frDa|42fyr7idp`kGtwYW?tMyc<Y_%E4HNZ%Zp7uSLk2GT
zgXlixKuZZ^<yFQD)BQ8O<&fj25_nPIz3rkmNZ`*vhe%+19Wwb{<~T`UE8Wp?64*v}
zG-CH!-O-5McDkc+64+9A^tTea*-FIu-tQ1#A)&9*9i8(6Z@dz1zUNiCtRyW!cOnVx
zA$I!0KPmVQOG9fe9c%;1l?BYorQ>fL^3*G9&EyTv#?t}6*QoTCS|*WyoaE_Io?1J{
zo`XHaiKqv#5tblC8htDQL>dDuA*5<lgyeuVEiC{UFu@WmkQ^}P@@)H*c8<Rw|LXLm
zABMp%b=wf*V=(A?zwqHaY`)aGPgNe4WS*Yu;pC|mFJGMg?d3(Q(XFbzarFO}ux!El
zukV6vY==CfePSCgXL^3y&m&&U<4HDQ6J>RI(v3nD1osi73Hg}uebZ{3A52yjFkgzm
z#ya&=>Aha~?yseu+KjWRS&4aqlOncK1t~{vC88Su*B_V;zA9UGp2D(Ot7;~uoLifU
zj$?(KTa&66!it;RI%&W&tVAk}euQDK%wJ|OWN6=F!7`rQa?W_6nm|DKv|Zbe;mdj=
z>P=8#JGoKCBCg!O{jw(W`<$7PQ^Qjgn=KTn>yY3!ri;Hbqp@+-7kj3*TUFtQ+E*j^
z?*ZiPdSv(zpqSfXO=I)_w9s)3-9$E~vB~$}$U1!0j{H1@w@u?p#YZyL4U|CUSOTtU
zRE6U5V)hZa&o`d#J-CeVgHx(Svd5gZmr{%u9DsEsM>N+1ng26nS!0hcz4GI-=08Uf
zDf-pd1#s~S0`~(?D}17h@t>nA-5q-vhgMLyA4sGILKZ7nS#iIs(%hmJU;5AyorSbo
z9EM&_z|=P{Qu$~>-Se1YJW==QD=y|KGJeus5bts9Q9VUJaR{*0k;Sps^ArQ0qU^UR
z@`2tn<PEv}S5MTPe8zJVr|nz22-<;(noaG0eL4FDeg5GwiePqoRtZ+#8ZUxO<>BI2
zZd!8sIGxw!(JP%`mu21!=CkJx)sy=R*<}Ianwi4V5!GY4DzWu^lT&J=zbfNyW)D%y
zdm`FDBp2C_%Aa)5ho=&P{ESU7{pZPU7AVxhK|RP%Pu~*#;Sj(0-NGUM{Z-6b==~3l
W^g(`xMhl<PL+(7JZ9@!2q5cJ^yC5L|

literal 0
HcmV?d00001

diff --git a/yara-x/src/modules/macho/tests/testdata/8962a76d0aeaee3326cf840de11543c8beebeb768e712bd3b754b5cd3e151356.out b/yara-x/src/modules/macho/tests/testdata/8962a76d0aeaee3326cf840de11543c8beebeb768e712bd3b754b5cd3e151356.out
new file mode 100644
index 000000000..62b3adab4
--- /dev/null
+++ b/yara-x/src/modules/macho/tests/testdata/8962a76d0aeaee3326cf840de11543c8beebeb768e712bd3b754b5cd3e151356.out
@@ -0,0 +1,81 @@
+magic: 0xcefaedfe
+cputype: 0xc
+cpusubtype: 0x6
+filetype: 2
+ncmds: 6
+sizeofcmds: 536
+flags: 0x2001
+number_of_segments: 4
+entry_point: 3476
+segments:
+  - segname: "__PAGEZERO"
+    vmaddr: 0x0
+    vmsize: 0x1000
+    fileoff: 0
+    filesize: 0
+    maxprot: 0x0
+    initprot: 0x0
+    nsects: 0
+    flags: 0x4
+  - segname: "__TEXT"
+    vmaddr: 0x1000
+    vmsize: 0x3000
+    fileoff: 0
+    filesize: 12288
+    maxprot: 0x7
+    initprot: 0x5
+    nsects: 2
+    flags: 0x0
+    sections:
+      - segname: "__TEXT"
+        sectname: "__text"
+        addr: 0x1d94
+        size: 0x2044
+        offset: 3476
+        align: 2
+        reloff: 0
+        nreloc: 0
+        flags: 0x0
+        reserved1: 0
+        reserved2: 0
+      - segname: "__TEXT"
+        sectname: "__cstring"
+        addr: 0x3de0
+        size: 0x210
+        offset: 11744
+        align: 4
+        reloff: 0
+        nreloc: 0
+        flags: 0x2
+        reserved1: 0
+        reserved2: 0
+  - segname: "__DATA"
+    vmaddr: 0x4000
+    vmsize: 0x1000
+    fileoff: 12288
+    filesize: 4096
+    maxprot: 0x7
+    initprot: 0x3
+    nsects: 1
+    flags: 0x0
+    sections:
+      - segname: "__DATA"
+        sectname: "__data"
+        addr: 0x4000
+        size: 0x4
+        offset: 12288
+        align: 2
+        reloff: 0
+        nreloc: 0
+        flags: 0x0
+        reserved1: 0
+        reserved2: 0
+  - segname: "__LINKEDIT"
+    vmaddr: 0x5000
+    vmsize: 0x1000
+    fileoff: 16384
+    filesize: 88
+    maxprot: 0x7
+    initprot: 0x1
+    nsects: 0
+    flags: 0x4
\ No newline at end of file
diff --git a/yara-x/src/modules/macho/tests/testdata/a1da3d22c5ec85143faf5f69fb18d79cb0e7394c7b5065f74b7ce8c52ace75f1.in.zip b/yara-x/src/modules/macho/tests/testdata/a1da3d22c5ec85143faf5f69fb18d79cb0e7394c7b5065f74b7ce8c52ace75f1.in.zip
new file mode 100644
index 0000000000000000000000000000000000000000..c0d94ba8aafaf1ac89f41189815f0ddc8e7259ea
GIT binary patch
literal 22453
zcmeHv3tW@+{=b)$%yO1>%p23=Nlz)Daue7kkEX{^R#`_)*(4Q2k)>QWwmlUodMv4<
zfoN={36;q(4C1maq(min1k!;61}%7iv5on#8_zEP?>4Su!1(?D{$BlGuOlyC4;#<r
z^Zk6^pZn+YycRt5v1cbe4u0O*w|>W@zJHvTADgs((&9;BtM`R@?_0BGukZf7YkgPy
zc!!6D`-b}kguk<T?LPm2z3;5r@9!Ppv)BI}-&KCT;r>4F`0w4ncCYW6u)X{JeZyCK
zMn=E&=2Mg0+W#ip-vRzxk8z1JCry6rvEnI{9@|EnJn7@c`uO=Li^8k1`Inkrd3pBB
zjnzWS(&s8gXY*^C0tDp&A(Cy6-+kjm+niqL0w3nf4M#+ud+7`^tsKRr7*J&iCbA$F
zfjP&2N1IO8=4a8w@t_iATB(FD<!JJ0<qBEd0*{o^V!p*3XPRGPTyE+u`cU^C-11!a
zi!42*w<Nbk2GxjX%py&umPP!8bx-SlMmVME7~Qg&w)sh+WjTAAw|=tzP<NZC1r?B|
zpAsG`upAcUgmoC6N#nxc@N6146&z-#amBekCAeTXcn7oT*k$A}IDB{+;pg@kpI=$c
zZd4_IgRIgl%;J{)7ITg{Ya1Na8L)+zGU7`{ZfsAS=&5nfvtL~LpPOP+;8^z?@({O*
zO_-cB&)HLloYhZXa_dxm92w^-ArDs@ig?pUUDmJ%pnD3>i<IT1V{@Ya62gw0LOw>2
zAGtUl@9bBU9^KDs6uW$LPpOzqcA0}a%|-CvWUo5exPEenY;khyZdPMNYV0K!3D<7u
zjduYfcRaTcaakTsY;PCIChwTSUi7n@tDEx#b6Mqr8USb3j9?f6hbMyJa&UM&7(N70
zopKp@VI@&@qXzX`Nu=M1rL0^@B!f>|dR{C77d{}<`XS^T;z|3$Y>RZOH8Wf}zfVp|
zuS49;=y5G9c7a8mj8zI=L`}(;Ce+szyt{9~kPILC0SoIXSGe?F(nnKX#4C9V#$))K
zZ`g2~tT>jQ@2Xau*mj!toEQ5>Hr1F7^Ig$jxGWR8<$S?)NC-4`%nl|A=<mJY06zHw
zq?gs8K-njRbubpBas9)Xxr^<9C$1#I8+aS<Y&~D_rsajvSDnj7EqjKcI86(ukAY(C
z9_572AJC(HsK0DN#~^3$!F{NYw6JElj{03dz;6sZ(TUdUmwLOvj<eK(8~wRR*Upx$
z8C$s?`LNG)yGgFR*X6R|!`5X=Ts2MSw6M1g#Lu__VrW(6r{{fCK!r_UGlL$Gc>vxo
zt|a2YVaZA&AD|qc#!Uyl%*<d|0uD23Wjld`^K=?l1rC2n<3?PhT&h}DX}fe_`-bD7
zjzg06BY2gDa4!1YU%z5(+Juhk`AFnfpB!9da-@ZDrfrdeH=2_a5C!vwxJculKU6r;
zJrBq*AO}N6C1<EK5bWDfZ8i+C?EM%Yl%;-;&aO)mu0y1ezTI#p*_Gh9OZ~qgy-ul8
zj%D`os=)=gM@j!99I^?cFA*%PRJ%<UKQY~X$%Hyt|H!A<m68?5{VW}mk!1b0n;P|6
zDIHFDXn6dvP<-pmAHN#YU^64c9BcgU7!B8LKCfJPCrwAoXGIBfA%aC`T<n#yUqtr8
z3bPAKq%t#^`fb<!di_;I#5#R7tkZC)o5xhHA<);9NX5dLiS1K7;F&Q-G_Tux_1hdN
z8R8*QX&c5g$H3%w5kq54`a?t|RUPTxUxkM4)TPLHyo|tDF8|%hsul?*sG4gme2<Jj
zE{MI?2>k*D5EM63Ri`Yv<QrRPq?wm=(;60~m2ph670*?2A%==)kx$_Uwr+=Yt-6`|
zm}iObA}^H*r5I7Ma2rP?m8H(qFa2d_ga`PNKlfeBj#N2^-E<*|vmq#`qWL+`=9>CM
zjd87+!-YJT&_jQc@%3J`qPA-dt=QkYMWheB**lvs1U!|mD+?oD)x|NWx5TPL@N@9?
zy8YW=@N`nqdwgy|xnVwOZa1?0P7cb#p0l)0sY?EOrp>7;(ZPJwX#9E+&jJyn#Fb2p
zeQOn*0BwBN5;r;Go$KK5DR^+HFDbRv6Hw`Iu27sT#1-GQ`g;{g79;;s8@gs?g}1a7
z4PYwIT39S@MSXVt&tweYZNH&{gz<i}pc}<fh?fn6oivm)7~AzFmqn!eW%A_Tmgoc!
zl@3F@#g$>RR+GK<loyG*c#!Blv1juY1fpL{msX(-n`r<+swiWJ_Ga-7jLF7t4UsFJ
z=V(fVo;nTtsg?Yx74Xcub#18_qMCcVvo=b27xKKJ_Db|@?%J0|R`G&X#UK8)UN18n
z*pqScOJ1?%RX2G|^Y)7^WOj{$!+I>}7V9q`mW!Gh1u^9P29$6`^m#!>%E~lyG_7fF
zcTsfj<D{ZaD$)#iekj|REm=^E$Cr}Aq?D5;qc*)UHMRN6JaxGQ4*kRsd*Q;*6?puw
zY}!wa=+OqQCFy1$h35gWzUrc#)IM#jRWmHIrFC0R=$=;d6K;MR?b*zu7aQC2Whh<;
zlj(m|-H>?RjSKM5wSG_Vx_7kKwBltks^V=&qoc`HxBN<s{}!1)^3VL(#Gl(vFW3j*
zRm7uz7hrz)LaSavk4fbix_A-i)CH>S&ii8QK}Yu2v2R^PZ)#$3B7TiwcKjV(lciU7
z7FLO{s6#^XFIf`d;#jv9oe6~xU0z=r*{w;>Qy1(iM9)h9fg!sPgPBxXKh>o0yT^*R
z7((u`HpVIgA3~nptiML{3QD;tpDDC)CjzeWrRm7Jw!ol_Rsm!#yx+B}Mo7LG(~zj*
z>B_O_JocjO`{hawiCUG7Ts>BHBt}4^BbC<{ya`aH)xofsA19Q=urq&QY>YCnUi~$t
z6FXVJkO_@dx-w5&ya1?qVPz`4r+zC2LUMO$`yAkq(83rj+0$8)1uf)8ywPx_*d4fj
z@pqsuM%AvMhWgtq;SyQUFVN}E3+q!XmAbsk0JJ6SE*@<&O_#$hfawyXMfaIm-X=xU
znj*1t%V}vkGs7TMa}pcx)a9g?DGketb&yI|?7jjlg{FhK1<zApuLziOMZq?yZ#Mpg
z4Q;%dj?CLBrGK9!yp67qVrTs`dkH`vsr*Ws?y0iP*k`qkmw_6~`8Gd=%+EZ1k!M2N
z47UyEC^?lP+zhlaq5@;8yrAMKDmZDr4nDG1I*ldekW9kGs-y)XTvp7pY!#1QE)^Z`
zS#+Xh{oL+*sEI7BFX1<W)uwdlt>)}uV&j&cj-=z~eY}9hI@YR2_MTJXj)SA`mU3j(
zB3@Z6YgVl~VDQ7BX|(%yfWh0w_LS_gvfYeQflxj%c#A>n<EZQ1YCo&qyT(e>hzyC<
zigc`he$ZVA>ty7zp+6e%UzyMshnmaL?7Mpu`NjeF6<?TQ;Ox6*!?0U9wNZV}>0NVS
zL@@A{pB#4u6JD)VH3IEQ8EFq4IaBr<>Q-C9*1S}i#5B3ed#Z&&z09ES0qwzX3h?TV
zUq;wFm{bt9dx9Vy_<qZ_z)yg9XVVU*5Cr(UzyX{Ba#`H%i?Zi#?Rx9HuBR6+AAQ3H
zV}8aeff+4%73ESbF0dBx8<!=9xZfy7IX~C*Y^S5gTpFA5uJEnHl!E+JCk&HZd1BU3
zbo4)BUDs%jxcalB18<M;lOB-qg9~#C4f~gNS>S42<WTOS8MB;wPaT&Woqb$B{r=9e
zoVX#mD0C0Tn2$MfYm`mvb8Kr}5da$ttwFL5h~#mnBI)p@-6tn1c+Pfcg#7gR<P;3(
zpD~i7{X1YR?djQbrtLFV`EAc0fOLTKG;PPpD<Dk^(px%^<pN>PVCsu7hdqC%Pb3ux
z{o^BucA{SFuvwwt;hf-d#0~mZ4Z`&$E~zbBl8O&@pg;B;6Pw8$lTT;(@MBf#*$&c>
zqBypDB%;QkMzShlB#3ZXSAf!Tw${3w_K_GQ)TPN%Mt<!ys3O!+8`z6n;R(==cBBC;
zq>Q9-Wa!YR%B@&%<cb4=Z98ZW=e7eqFoB%Ms~EE06&Uwf30J{IKF1A-tYLjIA-LcV
zSez+)x8zX}Z%y`kS7$H3e8I<dsWYZHa@D>AQx&`kq-L$lm_Tw4cO9aRiS~YZvuon_
zweTU=c7U|ZJCbzw(vsn)=L+Jrg9(fw7)?HWGjX9KFeSQwI1QWuj3f1{9O=mCA9kwy
z?NEDU3$-SbNFW58K!V%t0h!;=*Rf>Ft~m@ZW58?dvql_^k@-=4fI9_*2o{yHLZ->C
zK+hQTMpJwp+^+6!BGZMZv&#)XCUM@c-|Y{dy0+^y?LxUWZc0I=siyWR;OssO`~{ht
zBYsgqrM!vPrv4x*#$Pzf*1~gcsbksZS5iMBr`3uPsPR7_X4YYFfRHe&LY@?Mzp~ZL
z3_04kC|)N!dZ12QVKx}1V{&<bRGh&OrIPj#nT95^%1<ml^_hxUK(^@GAN*)O>esZr
z0bS!!E)O#hemTNYcwA8mAWn4z#5<&^Z$aO{3*iUKqMox-5DH{?s}rMW<W*Yszi1YL
zrPr8%%N6Nh6;x;T?%thKE@{grvd!W3J-4*jM~VcmCNh`9crF?1FhAfO_g8J>5bp1d
z`4;PlXA?+}E@M&8zTdleygk@t6}f8O!J>QK9U=t}QWgm<1pHYL0+2$rG~Vi$FP&CN
z%lHSC6{=J3tESy5k+^@^+r{Jawn4DoZ1~DZ)o8v_@G+!P^yc<GdiH10+yqL2N=myd
zX#2NVe747D`Q3x<0w_A}-eqVZURUlV3J+$1_{2i2e%p@*m%&Ha=31rvKC#ytb8r8W
zhZJsFLc$QsTKMX5kTc+cuuew62f_T*n<D=MA|3(=IE&(G0og@(+BBr>dwLiF;>rys
zgC0(`T!3~%&5ZAw^&w%V_aXE7D@r|LLXYSq%S#D_B$lYG66}!oA38Fu`)#2u4YpLl
z^AB5)iUW~ZSdqXQpp7`Jwq@f;HD-{dlq?9|5l!#9aWrYKJu%-)9!ShffoBVH_cU+_
zSV`o8!)lPNR|GPj;crGi)xy|Vc<wjsc3Z&$VFjrl*JIfXd*%usX(_>tF!lYn?Dt@R
zO0oM2n;wu=t|_*j$)ArPz4qSIqfq1~$!ha)R6V1fTS2XwD(Y!(8oExc><LG&xSvqF
z!Ux->8=@Za>EzK$KX%oYdL3#SVmj)SAx^dC|9~~NQ2)=et8y}Y#RuP^8OEGZIByH)
z%HjmCq9;L!h9C8;A@H&Dk^=1E(BN(6XJgp&zT&ObtP{`s@PJ3)ngeMQ$~g+&ShcEw
z3P7K*Tr{DM5zLT19|R;WD^<JYylol%w<!8>2$~#Nfy-Z>2s<^KBk#`06-<{zx+37#
zuqGdWhBLyVk0QUx9Wy@5@Zq&rcMjCo@_Dnp2Uq1tj9pNMvan7lbK*<)UuV||%O8-v
z`dN`n{9r=&ADtGECb7jqEZ4Wl8u1O=BIjjayHc}zUMID1@K`kTD?kv!b#FY=<~=cV
zfkN#-zGCUO<3k?wD{xPei2rQ($^e3=P*(`EJLM$MoG{k`gZ-P-uLW&egv;^?uVGo~
zvYUv^j<JA;?n%mT8K<&15YM|wW=_c*8K(`=1%niU$Uj4n?P_>sH=?dD(TW2YXm97q
zIEN4c2+0i~BpvnXef-A0+&!k`+Cd)y452;7lAKyOnqjc9-fm}kz|PLJ$!Qes{FrS@
zj^~eK%N@xXMHlo7s2%nhTDW+ujql$yLvn`_WG+CeFQNYiV_nwgS%W02t)DCsnVZJN
zgEFjp8kY_Z^V7Iq;IJ@_O96-H)3`WLzI`ef#&UZ==7Ra!)y?QJEi4)93H^jIR>k?)
z=qj+%g)AM9Ns{$6mwT-0sF}aJ4tm@tgfX{sNJ7-kd)Jp}Enl%fPmtd@s~Z9{P(~`5
zK*%)r0hvBbKMaa!Kd1Y&WzUDYE$6*@qJFm$qd*orrYs#Vw3`wD9P0)}@eg^Aqs;7n
zf)|ilkgv-nQUWG&{`iO)M$WkGMBSh&bvQb|OrfjLq9tf}F@fH>Fhm{~s!c76{#_&l
zCBxQSS^-vG6iSh^L+_j98D~swxs8H^V(-Nz;Los#5bakXHec(yUy1hQz*4*%4c4F*
zsn|sLi32JfVk~TDnkKf6Xko<cxZfz>`GYQ!1m6w!raYiZLBTVUbcV^jX)<iY;@HC5
z907^)yU9JeWjicYDa}mJ@DR1W=p0;ejl2-q*sK91M#`5e+69wr23@ZHMPx0=rpVAY
z6H-iQgOX>__ts{~_r)YO1t^(WT+t9m8Ptx2>_yy!cyqwNGK;x1qAr%1m%YE3z%PNc
zo#GrM0bW$*P80Fd5S;ht`i3&h9f{_=AS$WkbjxW%Bnc|b6IfR)J@f?*6E8_}=L)Q!
z_GXBh16ZM;MrtlRBrizT)|BlO!{)*~b-I61+#QiS4?3(DM<KV>a!_K;YvJ*J^hS$?
z{NHKht7g;5V(8b|?Y&K83!iddJi{aN<L$78^?g+#8wxSUY$@t_nicvBoPd?@tqH@5
z7Q%2(_loO{46Ke6k2Mxay3!C;g{tiK59rEr&?rX(y7$9Yy;aA|zPK3$xwi|eGGjq7
zMgYOsCCZ8iWGVPXHXnp&>A4F*8%F?%cjG9Fbi7s1db~nCkb}VGV_`9$0D)XKE`osc
zfDVP1h_r1$AYJQlkx;xZERbA>lxYD9UNQX@4B6z84Df->Ou#_~8BqTT=yH%8+&T^!
zHqp2HAwm%8&T-8Tu^Q=#lb*Dun)>bd?C&!~R^sb8JzY+7W5bwWx1u0%O246f<DD_>
z|4?lUfHgznv(Hui<1+8vYAZjcUN&sxy9%CKTNo#8*YHFj&RV*XC<R3_50Fs+2hjdH
zR@W5ztt>wK@Ulw(2V}@Kk4b@PqsM2F&G0dDO$RdN<MV$AQ>6zi#^+qe5dAu2cCkil
zty;RiN?SO&Kmi!qAMuSJPJC>w){k{sA5!}8xe-J7<6~za63XK(TkuF2vp5nkW>?Y#
zw8*34i(73=;bt_`Wj3zpS-qoYLU0F7g1``9%S0JI(nyPO0(G*42W0XDumBd3I)Tm2
zHlgEru|tLAzoa|*t#<F)Wv=H67R#bt*&kch<^4uiMjfn@Z+B!>*CCEe;)IV1fWI=V
z8{gR5t!y2&+5iv_dbypZjPXGEgD6V};wmr<Q4BgKKzMaw)uLFteZv7y$B}JLSzza7
zvKH1k{j<ZD_C$>ll*ouKIYzd^Fd6jLOd#?6U(y}tvHo0K&ksF+<i)FMr3=<iJHM4e
znA56@iVmO4qlu9pVj)3i5AuxZjM^u#_&>17=gG!J<g!1+ONF9*7EWaT{>6Ps$4xSW
z2=V=KVVcQY(uL$8;-uLEsab_6BVN~Qu*JPzyjWz_G_$Xs@_xcR?p(b|82*k{<Gw-U
zb@yS(s&X>f18RSu_vlukMobbF1VgioZc2h^s_G3bmOAxjLzbS2yGTO}x!+-BYMAm?
zXdt}($M>X%OQuK{MQrr}4WhMQ1%r~(3UkG$@4Elpba1wSWlDX^5EVvJ>DiMLYyly}
z>5T54?%8~G8z-|86|2Bio{8?Cn8B?@YMN*BcUwiI<aTRMtgQX}j<dSZpG-{h!uz#M
z8jrV0B^7gbWv>4Xtjt84+g&$}rC}M=Pa6X^oELN>AJELQrE77`?CQl#>5C$!(j!E)
z&_8W|eHYE5+YuiFcgcw-sO}YP5vI9O303Vsr}#<y<VA=&Lu4tG-2}fiH>yN1T1Mlo
zi`~kieSrXqIb^&MaHV#g5}Ee7TN+8+1%>{^$kD{?v*^_C8WaThZ-^XDZlCoYnu<P;
zit%pMmcSq3FPn)cIJ7V1N8eUf>}OEFZS6^7d!NG2uj^44%<Ms#qPRP9ej<lR4>HET
z-ga6qj+ou}qPewVL;1(L#Y}(R2}>QE)LH*?VW<V{5ajoRrCIiMRYk)EWABp}5qc1H
zchQs5^q6jB`Yj|ws;d62;U$ClRX?JIbi&M7hv*LDl@fl0(u<dSAtXatUfBYc&N0fT
zn9PTcdqaks*_aABC^X3A-Y2-hg=}{<*G;3)UZe6h6^m6BEj>n6h(U9oT(E&%wn2;$
z2o^(gW3*0IL=K%*aU?GYk4qQ(3mU3Y%G9xIx%BdRew^<Q&`s=0)12GAfv3=w%I(SR
zIvVE^%~QKVoZ$fp+^Rj=Ag@@1@DH@P)VhE3lz2<w%jHsCaq!&kRN70(w_OzvpNtST
zCAX`*_FJxB3+O^*g$C|a7PwYY&PiA+5Z=teH2G{!mWcGX6h%=$6fPS{$;wlcNPIrD
zgAVUn$S-S&7c7j2{p$smB$2ezqn@u@+<P)VMZ-8)j6jNf*z2H3q>g${1RkS#NLVVz
zwt}-61kqoGAq<q=iN1mYMhUJ+DJI>D2=^~P_j(}Ckruwh*&T$2ZU`l&$g=1Hi81J&
z@H!w%3K`_jCDQWYQ@zSUSP33A4I-wpH{H^C=nDP7BVx+GF<ezi^yUwImVooq@tdlJ
zlmA{4%cZ3s%v@U2p+{ux4NqGxu8S@3KQOydoiV-o(79;(hpn^TNtrT#gX+dnw<8PE
zf=&Pf#VZ59`(d&4Z$3unK6Q~E#`x(HH*z+6M#WV3Mc`ug=q^5E)l(NEWX4yL+jqGZ
zs7|lWJ7NYz>B7JR#!r?J&h=f;<KdchOKz`U3so;JN;&&T@8A0u*J6QnJyD;F00-^a
z=W&+cR=b$#S4HzVA#^bmJlVtO{b+i1frCrXUpE=-MTxiey$bY=gfA&B?v%0gnRZ=;
z-vZHiq||Xje%=GhMbn60l9DBC;PQZhAl9s4I2#;B?I4Yko)6r?<bW<x#=N8d&RJqQ
zPMzI5c8`x_=}cSPOE^cJ&1_RHV6JN)-iR{_7i{MXj~!g^^|%Xw8>lER7<V|eFVwWV
zYyTZKbwr)Ll;ZlFtRye6c-*4Y3pO|s&K(Z{<8GiIdu+(`m198NHjN;A!_^JNWidj}
zw0S6a6KH5+1Y_0?XcFj$-Ube!A9_7#nFjeE(n=yIyD&g4rT`q~<n!Ep?YK{}l^Z`k
zd%=hPjd`pxDAs1_XNx_N4k#Na`8vV8qO@T`=MR+R?0FH}N?g<B6Ph`+hi10H*?}hx
zFLMlAi%Ux#xY3`Bbj6aJ`-d%NgkS!9f93<1zkPE3knzM3XAbRfF4ZOn7Py-Gv-dH(
zI^GMWpqGLvXfV0xVn>EGgKV2z90%}O<$1$$qSh(s%&qoI2exlG4suN_VLyVc>9@w_
zbDPoAr`sH3umOdWFWxn8(6rj4?J-AAxkI~;#y@|UG}zVsX)Qb|IYT`Idz@JEhz1%T
zE$O+9(#El>tE8quv=ZusFR+Jf!kCGUWJUH(#gH=CShCV5+5fW%T&UA<Bxtv1D%x=*
zsd6*rLi|Ty7)&isBsWnh|A<y0@)ph8Pv~T9QK-LM!y-o|<@bQuvMntk=mrBA8hdC!
z#n^{hiTejhU@}XkEea61Uwxp!7iiRp#Pf-g60_Nq$838Ibf}V}E3gtGB^(XBTrP{F
z!r2j`6!FwMQZaf35&ym87|D{jmZ)ygw3|)xn8`_6OCH2U^~{0_w2@PFGqSe6^TjTm
z*?_)ZSi+Hd(o_Y~XzBs8FvHqH%4qzlcbf0iXo~osT?Jr@?pi3MEIeuL^=vDaE&s0V
zS<A04O&2jq7X9r8>4CS~cb0&j%-#T*Dz8`dWcs{=X6&E3-djfV^m0CZ3lXwv8^=kl
zVPjiEKiG}9*LBE~W1Vjqb?$q;^))wxbKiVm>z4KUd~m3y1Q_XOhf2hN)H-}=w-0l{
zkh$|TuXgF{!}?qL8sgjU-*!I773For*NNbcI)hfX%<f+HJIw<tA7!k}L3!Ej6=*NW
z9t+L=imp#B{J-LjLye>~UUq2Ii3n%oa2!`?1{(()sj%x~_S=kTxEPh+!}i8H_;2+l
zCNT3i!6~@f#;vx2r18QT8(H?vv<)PU_PVByo$otqDFc0z)vujtdqlHLb|y7BAHy1L
z_-$EbQqd1=Cv%8()VJPs*!VtNf^x{}L4!J=%Xgi0^i=FZ`^W~pf}UCE+)UJN8fdEQ
zQzM|@|6SgAeKGy^s#J^mXeZ`Kjlz-<<wm>OP`NbuIS^|;qS-;vK-N)e8@o#FU%A76
z4^zf{rq()Q=KSRzbGADw`Mx)sS#|yQ2Wm?Gf1H$ZtDU+KD4vcc*@(e9$;?70h_X9?
z&gQoA!v@~PGstK6E!%;syxqxESZ-+bNDMM^J<4$-zaF+x16Cwg@FV8(8{KTL&;m^m
zxCvsxi6R&U^`N7~#c@MhdH)fO;X$j2nKfToCyXXASZAAdvNc1NfSgn)cy$>F;kTZf
zHGLGsTi@jeUT#Bq)&GBSP|Cq$8rJn^*E@LY1fPRv;&i+17S8oCJoXmQx%|bZ_4fyX
zZ8h~timt&(Z3sr)Bp<2QI#~FH`Kn{jI|CEQOxASU-}5$LYCzi}P2yDdKjMYj+CKjz
z^M(@|!z1f;hYF_zf3Z9g2`iIDSU&F!Ztz|m$Z4R}93ll298HB9$d<foyQ#q)r~g?V
zP%X;rK?*Xqxs&IHdn3I`=|#}W;<!AjSdQw-Nybit=HoZzdj)(<!`YFxpD4)MByY?8
zu2@{lD(G&B350WKJu`Ij-hG&+mz9TnBMdpfokbGzJD?B^FQyn0qMCen@Xi-d_Dj^T
z){;7u-NuSIi?LkH^OK_@8ocfBESh9JzLczC1(?k*(7D%%pmTBS+Yc6aNLn?QAQ4%u
z3x&lrep|U%71LrUyEZcs(=5$5d}c%sxgT3=ZF4Lx6g8`GcO-9xrgxU}kR?A#c}on6
zB2#PU=ga4$sz5QU$Rzkk<Cpif4753lD(cALkH@kSw4#a~cwN;^`Ag>PkIJ-h;j<(|
zyB8VfAL>CsXE|!1C5a0CkFZocJc3jfD`y@S;`f_{S#5`O>U0wtZYX)3=c~$2$>%>C
z-g~rbslbG+uZ}TVwgk0Fo;WR1@}w3+;9d#5fP?o&UjH48K!J{8Fd+6q1J+yi>E663
zs`PFy6{+}H4W<X#uPQ+mv)ddgmKU*2?QNCl{a?(Qy%{Pg?_VHj_5MJ<7wuhLEU68P
zN&1)e$M3Q$zW+SuLb*9VD3&N<3LBy&m?6H9e5!<Oks0=PFzc16a#>LmMIK05#^L^4
zEX+R#CnXhBG8s)`h`?_#$<!s@B?Q&ayi_d12M@YlC5EFx)HIp;x`2zbkXj2{m<`b_
zXVXI%I@LCkA|9y~M?wKa3KmbyY&%_NrP)0%O|I@uY~t2QJ+VeMV|R3Mg}f!xv_DBw
z<-c<wxF?eRM_7`G7A?`3ne&7uEn~V;ZpdE<i&6AFU)p<MP*4_E&rKKmf_DTJQ@J!)
zELXGEhQb$+Y=t>6!IBD=ZW8W}r?A!@zK^P<;*I#TAWRnJe4He{IU@%N&So9o242T9
zcWvvoY}T=Dq=Y*KQ07C8oZ;Ja8eS1qh>w?>gc%XU)8IzvC9P3XRvQ(fGj%X##lu(3
z@r52RC0Q;rnm1<iWoq_9h>BL25(|~_*}5}SRp}nyF1{*RZ+R`)?QvnlyieHwnl#D!
z&fC|5Cr^2H>frluhyKm_KHUC)U%hYr?SJ9zxUU6In{Iv7WbpGTIL_K`{q%nT*5Gcp

literal 0
HcmV?d00001

diff --git a/yara-x/src/modules/macho/tests/testdata/a1da3d22c5ec85143faf5f69fb18d79cb0e7394c7b5065f74b7ce8c52ace75f1.out b/yara-x/src/modules/macho/tests/testdata/a1da3d22c5ec85143faf5f69fb18d79cb0e7394c7b5065f74b7ce8c52ace75f1.out
new file mode 100644
index 000000000..29dcbee41
--- /dev/null
+++ b/yara-x/src/modules/macho/tests/testdata/a1da3d22c5ec85143faf5f69fb18d79cb0e7394c7b5065f74b7ce8c52ace75f1.out
@@ -0,0 +1,338 @@
+fat_magic: 0xcafebabe
+nfat_arch: 2
+fat_arch:
+  - cputype: 0x1000007
+    cpusubtype: 0x3
+    offset: 16384
+    size: 33232
+    align: 14
+    reserved: 0
+  - cputype: 0x100000c
+    cpusubtype: 0x0
+    offset: 65536
+    size: 33528
+    align: 14
+    reserved: 0
+file:
+  - magic: 0xcffaedfe
+    cputype: 0x1000007
+    cpusubtype: 0x3
+    filetype: 2
+    ncmds: 15
+    sizeofcmds: 1688
+    flags: 0x200085
+    reserved: 0
+    number_of_segments: 4
+    dynamic_linker: "/usr/lib/dyld"
+    entry_point: 15952
+    segments:
+      - segname: "__PAGEZERO"
+        vmaddr: 0x0
+        vmsize: 0x100000000
+        fileoff: 0
+        filesize: 0
+        maxprot: 0x0
+        initprot: 0x0
+        nsects: 0
+        flags: 0x0
+      - segname: "__TEXT"
+        vmaddr: 0x100000000
+        vmsize: 0x4000
+        fileoff: 0
+        filesize: 16384
+        maxprot: 0x5
+        initprot: 0x5
+        nsects: 5
+        flags: 0x0
+        sections:
+          - segname: "__TEXT"
+            sectname: "__text"
+            addr: 0x100003e50
+            size: 0x93
+            offset: 15952
+            align: 4
+            reloff: 0
+            nreloc: 0
+            flags: 0x80000400
+            reserved1: 0
+            reserved2: 0
+            reserved3: 0
+          - segname: "__TEXT"
+            sectname: "__stubs"
+            addr: 0x100003ee4
+            size: 0x12
+            offset: 16100
+            align: 1
+            reloff: 0
+            nreloc: 0
+            flags: 0x80000408
+            reserved1: 0
+            reserved2: 6
+            reserved3: 0
+          - segname: "__TEXT"
+            sectname: "__stub_helper"
+            addr: 0x100003ef8
+            size: 0x2e
+            offset: 16120
+            align: 2
+            reloff: 0
+            nreloc: 0
+            flags: 0x80000400
+            reserved1: 0
+            reserved2: 0
+            reserved3: 0
+          - segname: "__TEXT"
+            sectname: "__unwind_info"
+            addr: 0x100003f28
+            size: 0x50
+            offset: 16168
+            align: 2
+            reloff: 0
+            nreloc: 0
+            flags: 0x0
+            reserved1: 0
+            reserved2: 0
+            reserved3: 0
+          - segname: "__TEXT"
+            sectname: "__eh_frame"
+            addr: 0x100003f78
+            size: 0x80
+            offset: 16248
+            align: 3
+            reloff: 0
+            nreloc: 0
+            flags: 0x0
+            reserved1: 0
+            reserved2: 0
+            reserved3: 0
+      - segname: "__DATA"
+        vmaddr: 0x100004000
+        vmsize: 0x4000
+        fileoff: 16384
+        filesize: 16384
+        maxprot: 0x3
+        initprot: 0x3
+        nsects: 5
+        flags: 0x0
+        sections:
+          - segname: "__DATA"
+            sectname: "__program_vars"
+            addr: 0x100004000
+            size: 0x28
+            offset: 16384
+            align: 3
+            reloff: 0
+            nreloc: 0
+            flags: 0x0
+            reserved1: 0
+            reserved2: 0
+            reserved3: 0
+          - segname: "__DATA"
+            sectname: "__nl_symbol_ptr"
+            addr: 0x100004028
+            size: 0x8
+            offset: 16424
+            align: 3
+            reloff: 0
+            nreloc: 0
+            flags: 0x6
+            reserved1: 3
+            reserved2: 0
+            reserved3: 0
+          - segname: "__DATA"
+            sectname: "__got"
+            addr: 0x100004030
+            size: 0x8
+            offset: 16432
+            align: 3
+            reloff: 0
+            nreloc: 0
+            flags: 0x6
+            reserved1: 4
+            reserved2: 0
+            reserved3: 0
+          - segname: "__DATA"
+            sectname: "__la_symbol_ptr"
+            addr: 0x100004038
+            size: 0x18
+            offset: 16440
+            align: 3
+            reloff: 0
+            nreloc: 0
+            flags: 0x7
+            reserved1: 5
+            reserved2: 0
+            reserved3: 0
+          - segname: "__DATA"
+            sectname: "__common"
+            addr: 0x100004050
+            size: 0x20
+            offset: 0
+            align: 3
+            reloff: 0
+            nreloc: 0
+            flags: 0x1
+            reserved1: 0
+            reserved2: 0
+            reserved3: 0
+      - segname: "__LINKEDIT"
+        vmaddr: 0x100008000
+        vmsize: 0x1d0
+        fileoff: 32768
+        filesize: 464
+        maxprot: 0x1
+        initprot: 0x1
+        nsects: 0
+        flags: 0x0
+    dylibs:
+      - name: "/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices"
+        timestamp: 2 # 1970-01-01 00:00:02 UTC
+        compatibility_version: "1.0.0"
+        current_version: "1141.1.0"
+      - name: "/usr/lib/libSystem.B.dylib"
+        timestamp: 2 # 1970-01-01 00:00:02 UTC
+        compatibility_version: "1.0.0"
+        current_version: "1311.120.1"
+    dysymtab:
+        ilocalsym: 0
+        nlocalsym: 1
+        iextdefsym: 1
+        nextdefsym: 1
+        tocoff: 2
+        ntoc: 4
+        modtaboff: 0
+        nmodtab: 0
+        extrefsymoff: 0
+        nextrefsyms: 0
+        indirectsymoff: 0
+        nindirectsyms: 0
+        extreloff: 33088
+        nextrel: 8
+        locreloff: 0
+        nlocrel: 0
+  - magic: 0xcffaedfe
+    cputype: 0x100000c
+    cpusubtype: 0x0
+    filetype: 2
+    ncmds: 18
+    sizeofcmds: 1080
+    flags: 0x200085
+    reserved: 0
+    number_of_segments: 4
+    dynamic_linker: "/usr/lib/dyld"
+    entry_point: 16184
+    stack_size: 0
+    source_version: "192.1.0.0.0"
+    segments:
+      - segname: "__PAGEZERO"
+        vmaddr: 0x0
+        vmsize: 0x100000000
+        fileoff: 0
+        filesize: 0
+        maxprot: 0x0
+        initprot: 0x0
+        nsects: 0
+        flags: 0x0
+      - segname: "__TEXT"
+        vmaddr: 0x100000000
+        vmsize: 0x4000
+        fileoff: 0
+        filesize: 16384
+        maxprot: 0x5
+        initprot: 0x5
+        nsects: 3
+        flags: 0x0
+        sections:
+          - segname: "__TEXT"
+            sectname: "__text"
+            addr: 0x100003f38
+            size: 0x68
+            offset: 16184
+            align: 2
+            reloff: 0
+            nreloc: 0
+            flags: 0x80000400
+            reserved1: 0
+            reserved2: 0
+            reserved3: 0
+          - segname: "__TEXT"
+            sectname: "__stubs"
+            addr: 0x100003fa0
+            size: 0x18
+            offset: 16288
+            align: 2
+            reloff: 0
+            nreloc: 0
+            flags: 0x80000408
+            reserved1: 0
+            reserved2: 12
+            reserved3: 0
+          - segname: "__TEXT"
+            sectname: "__unwind_info"
+            addr: 0x100003fb8
+            size: 0x48
+            offset: 16312
+            align: 2
+            reloff: 0
+            nreloc: 0
+            flags: 0x0
+            reserved1: 0
+            reserved2: 0
+            reserved3: 0
+      - segname: "__DATA_CONST"
+        vmaddr: 0x100004000
+        vmsize: 0x4000
+        fileoff: 16384
+        filesize: 16384
+        maxprot: 0x3
+        initprot: 0x3
+        nsects: 1
+        flags: 0x10
+        sections:
+          - segname: "__DATA_CONST"
+            sectname: "__got"
+            addr: 0x100004000
+            size: 0x10
+            offset: 16384
+            align: 3
+            reloff: 0
+            nreloc: 0
+            flags: 0x6
+            reserved1: 2
+            reserved2: 0
+            reserved3: 0
+      - segname: "__LINKEDIT"
+        vmaddr: 0x100008000
+        vmsize: 0x4000
+        fileoff: 32768
+        filesize: 760
+        maxprot: 0x1
+        initprot: 0x1
+        nsects: 0
+        flags: 0x0
+    dylibs:
+      - name: "/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices"
+        timestamp: 2 # 1970-01-01 00:00:02 UTC
+        compatibility_version: "1.0.0"
+        current_version: "1141.1.0"
+      - name: "/usr/lib/libSystem.B.dylib"
+        timestamp: 2 # 1970-01-01 00:00:02 UTC
+        compatibility_version: "1.0.0"
+        current_version: "1311.120.1"
+    dysymtab:
+        ilocalsym: 0
+        nlocalsym: 1
+        iextdefsym: 1
+        nextdefsym: 1
+        tocoff: 2
+        ntoc: 2
+        modtaboff: 0
+        nmodtab: 0
+        extrefsymoff: 0
+        nextrefsyms: 0
+        indirectsymoff: 0
+        nindirectsyms: 0
+        extreloff: 33008
+        nextrel: 4
+        locreloff: 0
+        nlocrel: 0
\ No newline at end of file