| 616 | } |
| 617 | |
| 618 | func TestOverrideProcExecutable(t *testing.T) { |
| 619 | hsnap := new(handle.SnapshotterMock) |
| 620 | hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil) |
| 621 | psnap := NewSnapshotter(hsnap, &config.Config{}) |
| 622 | defer psnap.Close() |
| 623 | |
| 624 | evt := &event.Event{ |
| 625 | Type: event.CreateProcess, |
| 626 | Params: event.Params{ |
| 627 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())}, |
| 628 | params.ProcessParentID: {Name: params.ProcessParentID, Type: params.PID, Value: uint32(os.Getppid())}, |
| 629 | params.ProcessName: {Name: params.ProcessName, Type: params.UnicodeString, Value: "spotify.exe"}, |
| 630 | params.Cmdline: {Name: params.Cmdline, Type: params.UnicodeString, Value: `Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--metrics-dir=C:\Users\admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.4.197 --initial-client-data=0x5a4,0x5a0,0x5a8,0x59c,0x5ac,0x6edcbf60,0x6edcbf70,0x6edcbf7c`}, |
| 631 | params.Exe: {Name: params.Exe, Type: params.UnicodeString, Value: `Spotify.exe`}, |
| 632 | params.UserSID: {Name: params.UserSID, Type: params.WbemSID, Value: []byte{224, 8, 226, 31, 15, 167, 255, 255, 0, 0, 0, 0, 15, 167, 255, 255, 1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0}}, |
| 633 | params.StartTime: {Name: params.StartTime, Type: params.Time, Value: time.Now()}, |
| 634 | params.SessionID: {Name: params.SessionID, Type: params.Uint32, Value: uint32(1)}, |
| 635 | params.ProcessFlags: {Name: params.ProcessFlags, Type: params.Flags, Value: uint32(0x00000010)}, |
| 636 | }, |
| 637 | } |
| 638 | require.NoError(t, psnap.Write(evt)) |
| 639 | |
| 640 | var tests = []struct { |
| 641 | expectedExe string |
| 642 | evt *event.Event |
| 643 | }{ |
| 644 | {`Spotify.exe`, |
| 645 | &event.Event{ |
| 646 | Type: event.LoadModule, |
| 647 | Params: event.Params{ |
| 648 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())}, |
| 649 | params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "C:\\Windows\\assembly\\NativeModules_v4.0.30319_32\\Microsoft.Dee252aac#\\707569faabe821b47fa4f59ecd9eb6ea\\Microsoft.Developer.IdentityService.ni.exe"}, |
| 650 | }, |
| 651 | }, |
| 652 | }, |
| 653 | {`Spotify.exe`, |
| 654 | &event.Event{ |
| 655 | Type: event.LoadModule, |
| 656 | Params: event.Params{ |
| 657 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())}, |
| 658 | params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "C:\\Windows\\System32\\notepad.exe"}, |
| 659 | }, |
| 660 | }, |
| 661 | }, |
| 662 | {`C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe`, |
| 663 | &event.Event{ |
| 664 | Type: event.LoadModule, |
| 665 | Params: event.Params{ |
| 666 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())}, |
| 667 | params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "C:\\Users\\admin\\AppData\\Roaming\\Spotify\\Spotify.exe"}, |
| 668 | }, |
| 669 | }, |
| 670 | }, |
| 671 | } |
| 672 | |
| 673 | for _, tt := range tests { |
| 674 | t.Run(tt.expectedExe, func(t *testing.T) { |
| 675 | evt := tt.evt |