Function TestAddModule

pkg/ps/snapshotter_windows_test.go:512–575

(t *testing.T)

}

func TestAddModule(t *testing.T) {
	hsnap := new(handle.SnapshotterMock)
	hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil)
	psnap := NewSnapshotter(hsnap, &config.Config{})
	defer psnap.Close()

	evt := &event.Event{
		Type: event.CreateProcess,
		Params: event.Params{
			params.ProcessID:       {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())},
			params.ProcessParentID: {Name: params.ProcessParentID, Type: params.PID, Value: uint32(os.Getppid())},
			params.ProcessName:     {Name: params.ProcessName, Type: params.UnicodeString, Value: "spotify.exe"},
			params.Cmdline:         {Name: params.Cmdline, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--metrics-dir=C:\Users\admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.4.197 --initial-client-data=0x5a4,0x5a0,0x5a8,0x59c,0x5ac,0x6edcbf60,0x6edcbf70,0x6edcbf7c`},
			params.Exe:             {Name: params.Exe, Type: params.UnicodeString, Value: `Spotify.exe`},
			params.UserSID:         {Name: params.UserSID, Type: params.WbemSID, Value: []byte{224, 8, 226, 31, 15, 167, 255, 255, 0, 0, 0, 0, 15, 167, 255, 255, 1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0}},
			params.StartTime:       {Name: params.StartTime, Type: params.Time, Value: time.Now()},
			params.SessionID:       {Name: params.SessionID, Type: params.Uint32, Value: uint32(1)},
			params.ProcessFlags:    {Name: params.ProcessFlags, Type: params.Flags, Value: uint32(0x00000010)},
		},
	}
	require.NoError(t, psnap.Write(evt))

	var tests = []struct {
		name string
		evt  *event.Event
		want bool
	}{
		{"add module to existing process",
			&event.Event{
				Type: event.LoadModule,
				Params: event.Params{
					params.ProcessID:  {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())},
					params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "C:\\Users\\admin\\AppData\\Roaming\\Spotify\\Spotify.exe"},
				},
			},
			true,
		},
		{"add module to absent process",
			&event.Event{
				Type: event.LoadModule,
				Params: event.Params{
					params.ProcessID:  {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid() + 1)},
					params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "C:\\Windows\\System32\\notepad.exe"},
				},
			},
			false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			evt := tt.evt
			exists := tt.want

			require.NoError(t, psnap.AddModule(evt))
			ok, proc := psnap.Find(evt.Params.MustGetPid())
			require.Equal(t, exists, ok)
			if ok {