| 93 | } |
| 94 | |
| 95 | func TestStackwalkDecoratorSurrogateProcess(t *testing.T) { |
| 96 | q := NewQueue(50, false, true) |
| 97 | cd := NewStackwalkDecorator(q) |
| 98 | |
| 99 | e := &Event{ |
| 100 | Type: CreateProcess, |
| 101 | Tid: 2484, |
| 102 | PID: 859, |
| 103 | CPU: 1, |
| 104 | Seq: 2, |
| 105 | Name: "CreateProcess", |
| 106 | Timestamp: time.Now(), |
| 107 | Category: Process, |
| 108 | Params: Params{ |
| 109 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(859)}, |
| 110 | params.ProcessParentID: {Name: params.ProcessParentID, Type: params.PID, Value: uint32(4523)}, |
| 111 | params.ProcessRealParentID: {Name: params.ProcessRealParentID, Type: params.PID, Value: uint32(8846)}, |
| 112 | }, |
| 113 | } |
| 114 | |
| 115 | e1 := &Event{ |
| 116 | Type: CreateThread, |
| 117 | Tid: 2484, |
| 118 | PID: 1411, |
| 119 | CPU: 1, |
| 120 | Seq: 3, |
| 121 | Name: "CreateThread", |
| 122 | Timestamp: time.Now(), |
| 123 | Category: Thread, |
| 124 | PS: &pstypes.PS{ |
| 125 | Name: "svchost.exe", |
| 126 | Exe: `C:\WINDOWS\system32\svchost.exe`, |
| 127 | Cmdline: `C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s seclogon`, |
| 128 | }, |
| 129 | Params: Params{ |
| 130 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(859)}, |
| 131 | }, |
| 132 | } |
| 133 | |
| 134 | cd.Push(e) |
| 135 | |
| 136 | assert.Len(t, cd.buckets[e.StackID()], 1) |
| 137 | assert.Len(t, cd.buckets[e1.StackID()], 0) |
| 138 | assert.Len(t, cd.procs, 1) |
| 139 | |
| 140 | cd.Push(e1) |
| 141 | assert.Len(t, cd.buckets[e1.StackID()], 1) |
| 142 | |
| 143 | sw := &Event{ |
| 144 | Type: StackWalk, |
| 145 | Tid: 2484, |
| 146 | PID: 1411, |
| 147 | CPU: 1, |
| 148 | Seq: 4, |
| 149 | Name: "StackWalk", |
| 150 | Timestamp: time.Now(), |
| 151 | Params: Params{ |
| 152 | params.Callstack: {Name: params.Callstack, Type: params.Slice, Value: []va.Address{0x7ffb5eb70dc4, 0x7ffb5c191deb, 0x7ffb3138592e}}, |