Function testCallstackEnrichment

internal/etw/source_test.go:842–1278

(t *testing.T, hsnap handle.Snapshotter, psnap ps.Snapshotter)

}

func testCallstackEnrichment(t *testing.T, hsnap handle.Snapshotter, psnap ps.Snapshotter) {
	event.DropCurrentProc = false

	var procHandle windows.Handle

	var tests = []*struct {
		name      string
		gen       func() error
		want      func(e *event.Event) bool
		completed bool
	}{
		{
			"create process callstack",
			func() error {
				var si windows.StartupInfo
				var pi windows.ProcessInformation
				argv, err := windows.UTF16PtrFromString(filepath.Join(os.Getenv("windir"), "notepad.exe"))
				if err != nil {
					return err
				}
				err = windows.CreateProcess(
					nil,
					argv,
					nil,
					nil,
					true,
					0,
					nil,
					nil,
					&si,
					&pi)
				if err != nil {
					return err
				}
				procHandle = pi.Process
				return nil
			},
			func(e *event.Event) bool {
				if e.IsCreateProcess() && e.Params.MustGetUint32(params.ProcessParentID) == uint32(os.Getpid()) &&
					strings.EqualFold(e.GetParamAsString(params.ProcessName), "notepad.exe") {
					callstack := e.Callstack.String()
					log.Infof("create process event %s: %s", e.String(), callstack)
					return callstackContainsTestExe(callstack) &&
						strings.Contains(strings.ToLower(callstack), strings.ToLower("\\WINDOWS\\System32\\KERNELBASE.dll!CreateProcessW"))
				}
				return false
			},
			false,
		},
		{
			"load Module callstack",
			nil,
			func(e *event.Event) bool {
				if e.IsLoadModule() && filepath.Ext(e.GetParamAsString(params.FilePath)) == ".dll" {
					callstack := e.Callstack.String()
					return strings.Contains(strings.ToLower(callstack), strings.ToLower("\\WINDOWS\\System32\\KERNELBASE.dll!LoadLibraryExW")) &&
						strings.Contains(strings.ToLower(callstack), strings.ToLower("\\WINDOWS\\system32\\ntoskrnl.exe!NtMapViewOfSection"))
				}