| 32 | ) |
| 33 | |
| 34 | func TestBatchMarshalJSON(t *testing.T) { |
| 35 | evt := &Event{ |
| 36 | Type: CreateFile, |
| 37 | Tid: 2484, |
| 38 | PID: 859, |
| 39 | CPU: 1, |
| 40 | Seq: 2, |
| 41 | Name: "CreateFile", |
| 42 | Timestamp: time.Now(), |
| 43 | Category: File, |
| 44 | Host: "archrabbit", |
| 45 | Description: "Creates or opens a new file, directory, I/O device, pipe, console", |
| 46 | Params: Params{ |
| 47 | params.FileObject: {Name: params.FileObject, Type: params.Uint64, Value: uint64(12456738026482168384)}, |
| 48 | params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: "\\Device\\HarddiskVolume2\\Windows\\system32\\user32.dll"}, |
| 49 | params.FileType: {Name: params.FileType, Type: params.AnsiString, Value: "file"}, |
| 50 | params.FileOperation: {Name: params.FileOperation, Type: params.AnsiString, Value: "open"}, |
| 51 | params.BasePrio: {Name: params.BasePrio, Type: params.Int8, Value: int8(2)}, |
| 52 | params.PagePrio: {Name: params.PagePrio, Type: params.Uint8, Value: uint8(2)}, |
| 53 | }, |
| 54 | Metadata: map[MetadataKey]any{"foo": "bar", "fooz": "baarz"}, |
| 55 | PS: &pstypes.PS{ |
| 56 | PID: 2436, |
| 57 | Ppid: 6304, |
| 58 | Name: "firefox.exe", |
| 59 | Exe: `C:\Program Files\Mozilla Firefox\firefox.exe`, |
| 60 | Cmdline: `C:\Program Files\Mozilla Firefox\firefox.exe -contentproc --channel="6304.3.1055809391\1014207667" -childID 1 -isForBrowser -prefsHandle 2584 -prefMapHandle 2580 -prefsLen 70 -prefMapSize 216993 -parentBuildID 20200107212822 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 6304 "\\.\pipe\gecko-crash-server-pipe.6304" 2596 tab`, |
| 61 | Cwd: `C:\Program Files\Mozilla Firefox\`, |
| 62 | SID: "archrabbit\\SYSTEM", |
| 63 | Args: []string{"-contentproc", `--channel=6304.3.1055809391\1014207667`, "-childID", "1", "-isForBrowser", "-prefsHandle", "2584", "-prefMapHandle", "2580", "-prefsLen", "70", "-prefMapSize", "216993", "-parentBuildID"}, |
| 64 | SessionID: 4, |
| 65 | Envs: map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"}, |
| 66 | Threads: map[uint32]pstypes.Thread{ |
| 67 | 3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)}, |
| 68 | 3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)}, |
| 69 | }, |
| 70 | Handles: []htypes.Handle{ |
| 71 | {Num: windows.Handle(0xffffd105e9baaf70), |
| 72 | Name: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b677c565-6ca5-45d3-b618-736b4e09b036}`, |
| 73 | Type: "Key", |
| 74 | Object: 777488883434455544, |
| 75 | Pid: uint32(1023), |
| 76 | }, |
| 77 | { |
| 78 | Num: windows.Handle(0xffffd105e9adaf70), |
| 79 | Name: `\RPC Control\OLEA61B27E13E028C4EA6C286932E80`, |
| 80 | Type: "ALPC Port", |
| 81 | Pid: uint32(1023), |
| 82 | MD: &htypes.AlpcPortInfo{ |
| 83 | Seqno: 1, |
| 84 | Context: 0x0, |
| 85 | Flags: 0x0, |
| 86 | }, |
| 87 | Object: 457488883434455544, |
| 88 | }, |
| 89 | { |
| 90 | Num: windows.Handle(0xeaffd105e9adaf30), |
| 91 | Name: `C:\Users\bunny`, |