Function TestProcessCallstack

pkg/symbolize/symbolizer_test.go:223–305

(t *testing.T)

}

func TestProcessCallstack(t *testing.T) {
	r := new(MockResolver)
	c := &config.Config{}

	psnap := new(ps.SnapshotterMock)

	opts := uint32(sys.SymUndname | sys.SymCaseInsensitive | sys.SymAutoPublics | sys.SymOmapFindNearest | sys.SymDeferredLoads)
	r.On("Initialize", mock.Anything, opts).Return(nil)
	r.On("LoadModule", windows.CurrentProcess(), mock.Anything).Return(nil)

	r.On("GetModuleName", mock.Anything, mock.Anything).Return("C:\\WINDOWS\\System32\\KERNEL32.DLL").Once()
	r.On("GetModuleName", mock.Anything, mock.Anything).Return("C:\\WINDOWS\\System32\\KERNELBASE.dll").Once()
	r.On("GetModuleName", mock.Anything, mock.Anything).Return("C:\\WINDOWS\\System32\\ntdll.dll").Times(3)

	r.On("GetSymbolNameAndOffset", mock.Anything, mock.Anything).Return("CreateProcessW", 0x54).Once()
	r.On("GetSymbolNameAndOffset", mock.Anything, mock.Anything).Return("CreateProcessW", 0x66).Once()
	r.On("GetSymbolNameAndOffset", mock.Anything, mock.Anything).Return("NtCreateProcess", 0x3a2).Once()
	r.On("GetSymbolNameAndOffset", mock.Anything, mock.Anything).Return("NtCreateProcessEx", 0x3a2).Times(2)

	r.On("Cleanup", mock.Anything)

	s := NewSymbolizer(r, psnap, c, false)
	require.NotNil(t, s)

	proc := &pstypes.PS{
		Name:      "notepad.exe",
		PID:       23234,
		Ppid:      2434,
		Exe:       `C:\Windows\notepad.exe`,
		Cmdline:   `C:\Windows\notepad.exe`,
		SID:       "S-1-1-18",
		Cwd:       `C:\Windows\`,
		SessionID: 1,
		Threads: map[uint32]pstypes.Thread{
			3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
			3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
		},
		Envs: map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"},
	}
	e := &event.Event{
		Type:      event.CreateProcess,
		Tid:       2484,
		PID:       2232,
		CPU:       1,
		Seq:       2,
		Name:      "CreatedProcess",
		Timestamp: time.Now(),
		Category:  event.Process,
		Host:      "archrabbit",
		Params: event.Params{
			params.ProcessParentID:     {Name: params.ProcessParentID, Type: params.PID, Value: (uint32(os.Getpid()))},
			params.ProcessRealParentID: {Name: params.ProcessRealParentID, Type: params.PID, Value: (uint32(os.Getpid()))},
			params.Callstack:           {Name: params.Callstack, Type: params.Slice, Value: []va.Address{0x7ffb5c1d0396, 0x7ffb5d8e61f4, 0x7ffb3138592e, 0x7ffb313853b2, 0x2638e59e0a5}},
		},
		PS: proc,
	}

	_, err := s.ProcessEvent(e)