(t *testing.T)
| 29 | ) |
| 30 | |
| 31 | func TestDirectSyscall(t *testing.T) { |
| 32 | var tests = []struct { |
| 33 | evt *event.Event |
| 34 | matches bool |
| 35 | }{ |
| 36 | {&event.Event{ |
| 37 | Type: event.CreateFile, |
| 38 | Tid: 2484, |
| 39 | PID: 859, |
| 40 | CPU: 1, |
| 41 | Seq: 2, |
| 42 | Name: "CreateFile", |
| 43 | Timestamp: time.Now(), |
| 44 | Category: event.File, |
| 45 | Params: event.Params{ |
| 46 | params.FileObject: {Name: params.FileObject, Type: params.Uint64, Value: uint64(12456738026482168384)}, |
| 47 | params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"}, |
| 48 | params.FileType: {Name: params.FileType, Type: params.AnsiString, Value: "file"}, |
| 49 | params.FileOperation: {Name: params.FileOperation, Type: params.Enum, Value: uint32(2), Enum: fs.FileCreateDispositions}, |
| 50 | }, |
| 51 | Callstack: callstackFromFrames( |
| 52 | callstack.Frame{Addr: 0xf259de, Module: "unbacked", Symbol: "?"}, |
| 53 | callstack.Frame{Addr: 0x7ffe4fda6e3b, Module: "C:\\Windows\\System32\\KernelBase.dll", Symbol: "SetThreadContext"}, |
| 54 | callstack.Frame{Addr: 0xfffff807e228c555, Module: "C:\\WINDOWS\\system32\\ntoskrnl.exe", Symbol: "setjmpex"}, |
| 55 | callstack.Frame{Addr: 0xfffff807e264805c, Module: "C:\\WINDOWS\\system32\\ntoskrnl.exe", Symbol: "ObOpenObjectByPointerWithTag"}), |
| 56 | }, true}, |
| 57 | {&event.Event{ |
| 58 | Type: event.CreateFile, |
| 59 | Tid: 2484, |
| 60 | PID: 859, |
| 61 | CPU: 1, |
| 62 | Seq: 2, |
| 63 | Name: "CreateFile", |
| 64 | Timestamp: time.Now(), |
| 65 | Category: event.File, |
| 66 | Params: event.Params{ |
| 67 | params.FileObject: {Name: params.FileObject, Type: params.Uint64, Value: uint64(12456738026482168384)}, |
| 68 | params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"}, |
| 69 | params.FileType: {Name: params.FileType, Type: params.AnsiString, Value: "file"}, |
| 70 | params.FileOperation: {Name: params.FileOperation, Type: params.Enum, Value: uint32(2), Enum: fs.FileCreateDispositions}, |
| 71 | }, |
| 72 | Callstack: callstackFromFrames( |
| 73 | callstack.Frame{Addr: 0xf259de, Module: "unbacked", Symbol: "?"}, |
| 74 | callstack.Frame{Addr: 0x7ffe4fda6e3b, Module: "C:\\Windows\\System32\\KernelBase.dll", Symbol: "SetThreadContext"}, |
| 75 | callstack.Frame{Addr: 0x7ffe52942b24, Module: "C:\\Windows\\System32\\ntdll.dll", Symbol: "ZwSetContextThread"}, |
| 76 | callstack.Frame{Addr: 0xfffff807e228c555, Module: "C:\\WINDOWS\\system32\\ntoskrnl.exe", Symbol: "setjmpex"}, |
| 77 | callstack.Frame{Addr: 0xfffff807e264805c, Module: "C:\\WINDOWS\\system32\\ntoskrnl.exe", Symbol: "ObOpenObjectByPointerWithTag"}), |
| 78 | }, false}, |
| 79 | {&event.Event{ |
| 80 | Type: event.CreateFile, |
| 81 | Tid: 2484, |
| 82 | PID: 859, |
| 83 | CPU: 1, |
| 84 | Seq: 2, |
| 85 | Name: "CreateFile", |
| 86 | Timestamp: time.Now(), |
| 87 | Category: event.File, |
| 88 | Params: event.Params{ |
nothing calls this directly
no test coverage detected