(t *testing.T)
| 381 | } |
| 382 | |
| 383 | func TestAddThread(t *testing.T) { |
| 384 | hsnap := new(handle.SnapshotterMock) |
| 385 | hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil) |
| 386 | psnap := NewSnapshotter(hsnap, &config.Config{}) |
| 387 | defer psnap.Close() |
| 388 | |
| 389 | evt := &event.Event{ |
| 390 | Type: event.CreateProcess, |
| 391 | Params: event.Params{ |
| 392 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())}, |
| 393 | params.ProcessParentID: {Name: params.ProcessParentID, Type: params.PID, Value: uint32(os.Getppid())}, |
| 394 | params.ProcessName: {Name: params.ProcessName, Type: params.UnicodeString, Value: "spotify.exe"}, |
| 395 | params.Cmdline: {Name: params.Cmdline, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--metrics-dir=C:\Users\admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.4.197 --initial-client-data=0x5a4,0x5a0,0x5a8,0x59c,0x5ac,0x6edcbf60,0x6edcbf70,0x6edcbf7c`}, |
| 396 | params.Exe: {Name: params.Exe, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --parent`}, |
| 397 | params.UserSID: {Name: params.UserSID, Type: params.WbemSID, Value: []byte{224, 8, 226, 31, 15, 167, 255, 255, 0, 0, 0, 0, 15, 167, 255, 255, 1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0}}, |
| 398 | params.StartTime: {Name: params.StartTime, Type: params.Time, Value: time.Now()}, |
| 399 | params.SessionID: {Name: params.SessionID, Type: params.Uint32, Value: uint32(1)}, |
| 400 | params.ProcessFlags: {Name: params.ProcessFlags, Type: params.Flags, Value: uint32(0x00000010)}, |
| 401 | }, |
| 402 | } |
| 403 | require.NoError(t, psnap.Write(evt)) |
| 404 | |
| 405 | var tests = []struct { |
| 406 | name string |
| 407 | evt *event.Event |
| 408 | want bool |
| 409 | }{ |
| 410 | {"add thread to existing process", |
| 411 | &event.Event{ |
| 412 | Type: event.CreateThread, |
| 413 | Params: event.Params{ |
| 414 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())}, |
| 415 | params.ThreadID: {Name: params.ThreadID, Type: params.TID, Value: uint32(3453)}, |
| 416 | params.BasePrio: {Name: params.BasePrio, Type: params.Uint8, Value: uint8(13)}, |
| 417 | params.StartAddress: {Name: params.StartAddress, Type: params.Address, Value: uint64(140729524944768)}, |
| 418 | params.IOPrio: {Name: params.IOPrio, Type: params.Uint8, Value: uint8(2)}, |
| 419 | params.KstackBase: {Name: params.KstackBase, Type: params.Address, Value: uint64(18446677035730165760)}, |
| 420 | params.KstackLimit: {Name: params.KstackLimit, Type: params.Address, Value: uint64(18446677035730137088)}, |
| 421 | params.PagePrio: {Name: params.PagePrio, Type: params.Uint8, Value: uint8(5)}, |
| 422 | params.UstackBase: {Name: params.UstackBase, Type: params.Address, Value: uint64(86376448)}, |
| 423 | params.UstackLimit: {Name: params.UstackLimit, Type: params.Address, Value: uint64(86372352)}, |
| 424 | }, |
| 425 | }, |
| 426 | true, |
| 427 | }, |
| 428 | {"add thread to absent process", |
| 429 | &event.Event{ |
| 430 | Type: event.CreateThread, |
| 431 | Params: event.Params{ |
| 432 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid() + 1)}, |
| 433 | params.ThreadID: {Name: params.ThreadID, Type: params.TID, Value: uint32(3453)}, |
| 434 | params.BasePrio: {Name: params.BasePrio, Type: params.Uint8, Value: uint8(13)}, |
| 435 | params.StartAddress: {Name: params.StartAddress, Type: params.Address, Value: uint64(140729524944768)}, |
| 436 | params.IOPrio: {Name: params.IOPrio, Type: params.Uint8, Value: uint8(2)}, |
| 437 | params.KstackBase: {Name: params.KstackBase, Type: params.Address, Value: uint64(18446677035730165760)}, |
| 438 | params.KstackLimit: {Name: params.KstackLimit, Type: params.Address, Value: uint64(18446677035730137088)}, |
| 439 | params.PagePrio: {Name: params.PagePrio, Type: params.Uint8, Value: uint8(5)}, |
| 440 | params.UstackBase: {Name: params.UstackBase, Type: params.Address, Value: uint64(86376448)}, |
nothing calls this directly
no test coverage detected