Function TestParseMem

pkg/pe/parser_test.go:105–149

(t *testing.T)

}

func TestParseMem(t *testing.T) {
	var tests = []struct {
		executable       string
		expectedSections int
	}{
		{filepath.Join(os.Getenv("windir"), "regedit.exe"), 8},
	}

	for _, tt := range tests {
		var si windows.StartupInfo
		var pi windows.ProcessInformation
		argv := windows.StringToUTF16Ptr(tt.executable)
		err := windows.CreateProcess(
			nil,
			argv,
			nil,
			nil,
			true,
			0,
			nil,
			nil,
			&si,
			&pi)
		require.NoError(t, err)
		time.Sleep(time.Millisecond * 300)
		defer func() {
			_ = windows.TerminateProcess(pi.Process, 0)
		}()
		addr, err := getModuleBaseAddress(pi.ProcessId)
		if err != nil {
			t.Fatalf("%s: unable to get the base address: %v", tt.executable, err)
		}

		pe, err := ParseMem(pi.ProcessId, addr, false, WithSections())
		if err != nil {
			t.Fatalf("%s: %v", tt.executable, err)
		}
		if pe == nil {
			t.Fatalf("%s: PE metadata is nil", tt.executable)
		}
		if len(pe.Sections) != tt.expectedSections {
			t.Errorf("%s: expected: %d, got %d sections", tt.executable, tt.expectedSections, len(pe.Sections))
		}
	}
}

func getModuleBaseAddress(pid uint32) (uintptr, error) {
	var moduleHandles [1024]windows.Handle