(t *testing.T)
| 462 | } |
| 463 | |
| 464 | func TestRemoveThread(t *testing.T) { |
| 465 | hsnap := new(handle.SnapshotterMock) |
| 466 | psnap := NewSnapshotter(hsnap, &config.Config{}) |
| 467 | hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil) |
| 468 | defer psnap.Close() |
| 469 | |
| 470 | pevt := &event.Event{ |
| 471 | Type: event.CreateProcess, |
| 472 | Params: event.Params{ |
| 473 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())}, |
| 474 | params.ProcessParentID: {Name: params.ProcessParentID, Type: params.PID, Value: uint32(os.Getppid())}, |
| 475 | params.ProcessName: {Name: params.ProcessName, Type: params.UnicodeString, Value: "spotify.exe"}, |
| 476 | params.Cmdline: {Name: params.Cmdline, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--metrics-dir=C:\Users\admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.4.197 --initial-client-data=0x5a4,0x5a0,0x5a8,0x59c,0x5ac,0x6edcbf60,0x6edcbf70,0x6edcbf7c`}, |
| 477 | params.Exe: {Name: params.Exe, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --parent`}, |
| 478 | params.UserSID: {Name: params.UserSID, Type: params.WbemSID, Value: []byte{224, 8, 226, 31, 15, 167, 255, 255, 0, 0, 0, 0, 15, 167, 255, 255, 1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0}}, |
| 479 | params.StartTime: {Name: params.StartTime, Type: params.Time, Value: time.Now()}, |
| 480 | params.SessionID: {Name: params.SessionID, Type: params.Uint32, Value: uint32(1)}, |
| 481 | params.ProcessFlags: {Name: params.ProcessFlags, Type: params.Flags, Value: uint32(0x00000010)}, |
| 482 | }, |
| 483 | } |
| 484 | require.NoError(t, psnap.Write(pevt)) |
| 485 | |
| 486 | tevt := &event.Event{ |
| 487 | Type: event.CreateThread, |
| 488 | Params: event.Params{ |
| 489 | params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(os.Getpid())}, |
| 490 | params.ThreadID: {Name: params.ThreadID, Type: params.TID, Value: uint32(3453)}, |
| 491 | params.BasePrio: {Name: params.BasePrio, Type: params.Uint8, Value: uint8(13)}, |
| 492 | params.StartAddress: {Name: params.StartAddress, Type: params.Address, Value: uint64(140729524944768)}, |
| 493 | params.IOPrio: {Name: params.IOPrio, Type: params.Uint8, Value: uint8(2)}, |
| 494 | params.KstackBase: {Name: params.KstackBase, Type: params.Address, Value: uint64(18446677035730165760)}, |
| 495 | params.KstackLimit: {Name: params.KstackLimit, Type: params.Address, Value: uint64(18446677035730137088)}, |
| 496 | params.PagePrio: {Name: params.PagePrio, Type: params.Uint8, Value: uint8(5)}, |
| 497 | params.UstackBase: {Name: params.UstackBase, Type: params.Address, Value: uint64(86376448)}, |
| 498 | params.UstackLimit: {Name: params.UstackLimit, Type: params.Address, Value: uint64(86372352)}, |
| 499 | }, |
| 500 | } |
| 501 | |
| 502 | require.NoError(t, psnap.AddThread(tevt)) |
| 503 | |
| 504 | ok, ps := psnap.Find(uint32(os.Getpid())) |
| 505 | require.True(t, ok) |
| 506 | require.NotNil(t, ps) |
| 507 | require.Len(t, ps.Threads, 1) |
| 508 | require.NoError(t, psnap.RemoveThread(uint32(os.Getpid()), 3453)) |
| 509 | require.Len(t, ps.Threads, 0) |
| 510 | } |
| 511 | |
| 512 | func TestAddModule(t *testing.T) { |
| 513 | hsnap := new(handle.SnapshotterMock) |
nothing calls this directly
no test coverage detected