| 29 | ) |
| 30 | |
| 31 | func TestDecode(t *testing.T) { |
| 32 | ntdll, err := windows.LoadLibrary("kernel32.dll") |
| 33 | require.NoError(t, err) |
| 34 | |
| 35 | fn, err := windows.GetProcAddress(ntdll, "VirtualProtect") |
| 36 | require.NoError(t, err) |
| 37 | |
| 38 | ctx := Context{ |
| 39 | Rip: uint64(fn), |
| 40 | } |
| 41 | |
| 42 | const sz = int(unsafe.Sizeof(Context{})) |
| 43 | b := (*(*[sz]byte)(unsafe.Pointer(&ctx)))[:] |
| 44 | |
| 45 | addr, err := windows.VirtualAlloc(0, uintptr(sz), windows.MEM_COMMIT, windows.PAGE_EXECUTE_READWRITE) |
| 46 | require.NoError(t, err) |
| 47 | |
| 48 | var n uintptr |
| 49 | require.NoError(t, windows.WriteProcessMemory(windows.CurrentProcess(), addr, &b[0], uintptr(sz), &n)) |
| 50 | |
| 51 | c := Decode(uint32(os.Getpid()), va.Address(addr)) |
| 52 | |
| 53 | require.NotNil(t, c) |
| 54 | require.Equal(t, fn, uintptr(c.Rip)) |
| 55 | } |
| 56 | |
| 57 | func TestIsParamOfFunc(t *testing.T) { |
| 58 | var tests = []struct { |