(t *testing.T)
| 34 | ) |
| 35 | |
| 36 | func TestModuleProcessor(t *testing.T) { |
| 37 | var tests = []struct { |
| 38 | name string |
| 39 | e *event.Event |
| 40 | psnap func() *ps.SnapshotterMock |
| 41 | assertions func(*event.Event, *testing.T, *ps.SnapshotterMock) |
| 42 | }{ |
| 43 | { |
| 44 | "load new module", |
| 45 | &event.Event{ |
| 46 | Type: event.LoadModule, |
| 47 | Params: event.Params{ |
| 48 | params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: filepath.Join(os.Getenv("windir"), "System32", "kernel32.dll")}, |
| 49 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)}, |
| 50 | params.ModuleCheckSum: {Name: params.ModuleCheckSum, Type: params.Uint32, Value: uint32(2323432)}, |
| 51 | params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0x7ffb313833a3)}, |
| 52 | params.ModuleSignatureType: {Name: params.ModuleSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types}, |
| 53 | params.ModuleSignatureLevel: {Name: params.ModuleSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels}, |
| 54 | }, |
| 55 | }, |
| 56 | func() *ps.SnapshotterMock { |
| 57 | psnap := new(ps.SnapshotterMock) |
| 58 | psnap.On("AddModule", mock.Anything).Return(nil) |
| 59 | return psnap |
| 60 | }, |
| 61 | func(e *event.Event, t *testing.T, psnap *ps.SnapshotterMock) { |
| 62 | psnap.AssertNumberOfCalls(t, "AddModule", 1) |
| 63 | // should get the signature verified |
| 64 | assert.Equal(t, "EMBEDDED", e.GetParamAsString(params.ModuleSignatureType)) |
| 65 | assert.Equal(t, "AUTHENTICODE", e.GetParamAsString(params.ModuleSignatureLevel)) |
| 66 | }, |
| 67 | }, |
| 68 | { |
| 69 | "parse module characteristics", |
| 70 | &event.Event{ |
| 71 | Type: event.LoadModule, |
| 72 | Params: event.Params{ |
| 73 | params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "../_fixtures/mscorlib.dll"}, |
| 74 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)}, |
| 75 | params.ModuleCheckSum: {Name: params.ModuleCheckSum, Type: params.Uint32, Value: uint32(2323432)}, |
| 76 | params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0x7ffb313833a3)}, |
| 77 | params.ModuleSignatureType: {Name: params.ModuleSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types}, |
| 78 | params.ModuleSignatureLevel: {Name: params.ModuleSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels}, |
| 79 | }, |
| 80 | }, |
| 81 | func() *ps.SnapshotterMock { |
| 82 | psnap := new(ps.SnapshotterMock) |
| 83 | psnap.On("AddModule", mock.Anything).Return(nil) |
| 84 | return psnap |
| 85 | }, |
| 86 | func(e *event.Event, t *testing.T, psnap *ps.SnapshotterMock) { |
| 87 | psnap.AssertNumberOfCalls(t, "AddModule", 1) |
| 88 | }, |
| 89 | }, |
| 90 | { |
| 91 | "unload module", |
| 92 | &event.Event{ |
| 93 | Type: event.UnloadModule, |
nothing calls this directly
no test coverage detected