(self)
| 89 | assert False, "invalid Context field" |
| 90 | |
| 91 | def test_modules(self): |
| 92 | parser = udmp_parser.UserDumpParser() |
| 93 | assert parser.Parse(self.minidump_file) |
| 94 | modules = parser.Modules() |
| 95 | assert len(modules) |
| 96 | |
| 97 | ntdll_modules = [ |
| 98 | mod |
| 99 | for _, mod in modules.items() |
| 100 | if mod.ModuleName.lower().endswith("ntdll.dll") |
| 101 | ] |
| 102 | kernel32_modules = [ |
| 103 | mod |
| 104 | for _, mod in modules.items() |
| 105 | if mod.ModuleName.lower().endswith("kernel32.dll") |
| 106 | ] |
| 107 | |
| 108 | assert len(ntdll_modules) >= 1 |
| 109 | assert len(kernel32_modules) >= 1 |
| 110 | |
| 111 | for mod in ntdll_modules + kernel32_modules: |
| 112 | assert mod.BaseOfImage > 0, f"Invalid BaseOfImage for '{mod}'" |
| 113 | assert mod.SizeOfImage > 0, f"Invalid SizeOfImage for '{mod}'" |
| 114 | module_raw = parser.ReadMemory(mod.BaseOfImage, mod.SizeOfImage) |
| 115 | img = lief.PE.parse(raw=module_raw) |
| 116 | assert img |
| 117 | assert img.header.numberof_sections |
| 118 | assert img.optional_header.sizeof_code |
| 119 | assert img.optional_header.imagebase |
| 120 | |
| 121 | def test_memory(self): |
| 122 | parser = udmp_parser.UserDumpParser() |
nothing calls this directly
no test coverage detected