Function TestEventSourceRundownEvents

internal/etw/source_test.go:309–383

(t *testing.T)

}

func TestEventSourceRundownEvents(t *testing.T) {
	psnap := new(ps.SnapshotterMock)
	psnap.On("Write", mock.Anything).Return(nil)
	psnap.On("AddThread", mock.Anything).Return(nil)
	psnap.On("AddModule", mock.Anything).Return(nil)
	psnap.On("AddMmap", mock.Anything).Return(nil)
	psnap.On("RemoveMmap", mock.Anything, mock.Anything).Return(nil)
	psnap.On("RemoveThread", mock.Anything, mock.Anything).Return(nil)
	psnap.On("RemoveModule", mock.Anything, mock.Anything).Return(nil)
	psnap.On("FindModule", mock.Anything).Return(false, nil)
	psnap.On("FindAndPut", mock.Anything).Return(&pstypes.PS{})
	psnap.On("Find", mock.Anything).Return(true, &pstypes.PS{})
	psnap.On("Remove", mock.Anything).Return(nil)

	hsnap := new(handle.SnapshotterMock)
	hsnap.On("FindByObject", mock.Anything).Return(htypes.Handle{}, false)
	hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil)

	evsConfig := config.EventSourceConfig{
		EnableThreadEvents:   true,
		EnableModuleEvents:   true,
		EnableFileIOEvents:   true,
		EnableNetEvents:      true,
		EnableRegistryEvents: true,
	}
	cfg := &config.Config{
		EventSource: evsConfig,
		CapFile:     "fake.cap", // simulate capture to receive state/rundown events
		Filters:     &config.Filters{},
	}

	cfg.EventSource.Init()
	evs := NewEventSource(psnap, hsnap, cfg, nil)

	l := &MockListener{}
	evs.RegisterEventListener(l)
	require.NoError(t, evs.Open(cfg))
	defer evs.Close()

	rundownsByType := map[event.Type]bool{
		event.ProcessRundown: false,
		event.ThreadRundown:  false,
		event.ModuleRundown:  false,
		event.FileRundown:    false,
		event.RegKCBRundown:  false,
	}
	rundownsByHash := make(map[uint64]uint8)
	timeout := time.After(time.Minute)

	for {
		select {
		case e := <-evs.Events():
			if !e.IsRundown() {
				continue
			}
			rundownsByType[e.Type] = true
			rundownsByHash[e.RundownKey()]++
		case err := <-evs.Errors():