Function TestRemoveModule

pkg/ps/snapshotter_windows_test.go:577–616

(t *testing.T)

}

func TestRemoveModule(t *testing.T) {
	hsnap := new(handle.SnapshotterMock)
	hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil)
	psnap := NewSnapshotter(hsnap, &config.Config{})
	defer psnap.Close()

	pevt := &event.Event{
		Type: event.CreateProcess,
		Params: event.Params{
			params.ProcessID:       {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())},
			params.ProcessParentID: {Name: params.ProcessParentID, Type: params.PID, Value: uint32(os.Getppid())},
			params.ProcessName:     {Name: params.ProcessName, Type: params.UnicodeString, Value: "spotify.exe"},
			params.Cmdline:         {Name: params.Cmdline, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--metrics-dir=C:\Users\admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.4.197 --initial-client-data=0x5a4,0x5a0,0x5a8,0x59c,0x5ac,0x6edcbf60,0x6edcbf70,0x6edcbf7c`},
			params.Exe:             {Name: params.Exe, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --parent`},
			params.UserSID:         {Name: params.UserSID, Type: params.WbemSID, Value: []byte{224, 8, 226, 31, 15, 167, 255, 255, 0, 0, 0, 0, 15, 167, 255, 255, 1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0}},
			params.StartTime:       {Name: params.StartTime, Type: params.Time, Value: time.Now()},
			params.SessionID:       {Name: params.SessionID, Type: params.Uint32, Value: uint32(1)},
			params.ProcessFlags:    {Name: params.ProcessFlags, Type: params.Flags, Value: uint32(0x00000010)},
		},
	}
	require.NoError(t, psnap.Write(pevt))

	mevt := &event.Event{
		Type: event.LoadModule,
		Params: event.Params{
			params.ProcessID:  {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())},
			params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "C:\\Windows\\System32\\notepad.exe"},
			params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0xffff7656)},
		},
	}

	require.NoError(t, psnap.AddModule(mevt))

	ok, ps := psnap.Find(uint32(os.Getpid()))
	require.True(t, ok)
	require.NotNil(t, ps)
	require.Len(t, ps.Modules, 1)
	require.NoError(t, psnap.RemoveModule(uint32(os.Getpid()), va.Address(0xffff7656)))
	require.Len(t, ps.Modules, 0)
}

func TestOverrideProcExecutable(t *testing.T) {
	hsnap := new(handle.SnapshotterMock)