Function TestStackExtensions

internal/etw/stackext_test.go:30–60

(t *testing.T)

)

func TestStackExtensions(t *testing.T) {
	cfg := &config.Config{
		EventSource: config.EventSourceConfig{
			EnableThreadEvents: true,
			EnableNetEvents:    true,
			EnableFileIOEvents: true,
			EnableMemEvents:    true,
			BufferSize:         1024,
			FlushTimer:         time.Millisecond * 2300,
		},
	}

	cfg.EventSource.Init()

	exts := NewStackExtensions(cfg.EventSource)
	assert.Len(t, exts.EventIds(), 0)

	exts.EnableProcessCallstack()
	exts.EnableRegistryCallstack()
	exts.EnableFileCallstack()
	exts.EnableMemoryCallstack()

	assert.Len(t, exts.EventIds(), 7)
	assert.Contains(t, exts.EventIds(), etw.ClassicEventID{GUID: event.ProcessEventGUID, Type: uint8(event.CreateProcess.HookID())})
	assert.Contains(t, exts.EventIds(), etw.ClassicEventID{GUID: event.ThreadEventGUID, Type: uint8(event.CreateThread.HookID())})
	assert.Contains(t, exts.EventIds(), etw.ClassicEventID{GUID: event.ThreadEventGUID, Type: uint8(event.TerminateThread.HookID())})
	assert.Contains(t, exts.EventIds(), etw.ClassicEventID{GUID: event.FileEventGUID, Type: uint8(event.CreateFile.HookID())})
	assert.Contains(t, exts.EventIds(), etw.ClassicEventID{GUID: event.FileEventGUID, Type: uint8(event.RenameFile.HookID())})
	assert.Contains(t, exts.EventIds(), etw.ClassicEventID{GUID: event.FileEventGUID, Type: uint8(event.DeleteFile.HookID())})
	assert.Contains(t, exts.EventIds(), etw.ClassicEventID{GUID: event.MemEventGUID, Type: uint8(event.VirtualAlloc.HookID())})
}