eronnen-procmon-parser/tests/conftest.py

import binascii
import os
import time
import zlib
from io import StringIO, BytesIO

import pytest
from six import PY2

from procmon_parser import ProcmonLogsReader

if PY2:
    from unicodecsv import DictReader
    from codecs import BOM_UTF8
else:
    from csv import DictReader


RESOURCES_DIRECTORY = os.path.join(os.path.dirname(__file__), "resources")


def decompress_resource(resource_filename):
    with open(os.path.join(RESOURCES_DIRECTORY, resource_filename), "rb") as f:
        return zlib.decompress(f.read())


@pytest.fixture(scope='session')
def pml_logs_windows7_32bit():
    return decompress_resource("CompressedLogfileTests32bitUTCPML")


@pytest.fixture(scope='session')
def csv_logs_windows7_32bit():
    return decompress_resource("CompressedLogfileTests32bitUTCCSV")


@pytest.fixture(scope='session')
def pml_logs_windows10_64bit():
    return decompress_resource("CompressedLogfileTests64bitUTCPML")


@pytest.fixture(scope='session')
def csv_logs_windows10_64bit():
    return decompress_resource("CompressedLogfileTests64bitUTCCSV")


def get_pml_log_reader(pml_logs):
    pml_stream = BytesIO(pml_logs)
    start = time.time()
    pml_reader = ProcmonLogsReader(pml_stream)
    print("\nLoading PML reader took {} seconds\n".format(time.time() - start))
    return pml_reader


def get_csv_log_reader(csv_logs):
    if PY2:
        csv_stream = BytesIO(csv_logs)
        bom = csv_stream.read(len(BOM_UTF8))
        assert bom == BOM_UTF8, "Unexpected Procmon csv encoding"
        csv_reader = DictReader(csv_stream, encoding='utf-8')
    else:
        csv_stream = StringIO(csv_logs.decode('utf-8-sig'))
        csv_reader = DictReader(csv_stream)
    return csv_reader


@pytest.fixture(scope='function')
def pml_reader_windows7_32bit(pml_logs_windows7_32bit):
    return get_pml_log_reader(pml_logs_windows7_32bit)


@pytest.fixture(scope='function')
def csv_reader_windows7_32bit(csv_logs_windows7_32bit):
    return get_csv_log_reader(csv_logs_windows7_32bit)


@pytest.fixture(scope='function')
def pml_reader_windows10_64bit(pml_logs_windows10_64bit):
    return get_pml_log_reader(pml_logs_windows10_64bit)


@pytest.fixture(scope='function')
def csv_reader_windows10_64bit(csv_logs_windows10_64bit):
    return get_csv_log_reader(csv_logs_windows10_64bit)


@pytest.fixture(scope='function',
                params=[('CompressedLogFileUTC32FilesystemCSV', 'CompressedLogFileUTC32FilesystemPML'),
                        ('CompressedLogFileUTC64FilesystemCSV', 'CompressedLogFileUTC64FilesystemPML'),
                        ('CompressedLogFileUTC64ProcessCSV', 'CompressedLogFileUTC64ProcessPML'),
                        ('CompressedLogFileUTC64RegistryCSV', 'CompressedLogFileUTC64RegistryPML')])
def specific_events_logs_readers(request):
    return get_csv_log_reader(decompress_resource(request.param[0])), \
           get_pml_log_reader(decompress_resource(request.param[1]))


@pytest.fixture()
def raw_config_full():
    """a raw PMC binary data taken from my computer
    """
    return binascii.unhexlify('a000000010000000200000008000000043006f006c0075006d006e0073000000840057006400c80064009600'
                              '6400640064006400640064006400640064006400640064006400640064006400640064006400640064000000'
                              '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
                              '000000000000000000000000000000000000000000000000000000002c000000100000002800000004000000'
                              '43006f006c0075006d006e0043006f0075006e00740000001b00000024010000100000002400000000010000'
                              '43006f006c0075006d006e004d006100700000008e9c0000759c0000779c0000879c0000799c0000749c0000'
                              '8c9c00008d9c0000e49c0000929c00007a9c0000849c0000839c0000939c0000889c0000949c0000959c0000'
                              '969c0000979c0000989c0000769c0000789c0000809c0000819c0000919c0000859c0000829c000000000000'
                              '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
                              '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
                              '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
                              '0000000000000000000000006600000010000000280000003e000000440062006700480065006c0070005000'
                              '610074006800000043003a005c00570069006e0064006f00770073005c00530059005300540045004d003300'
                              '32005c00640062006700680065006c0070002e0064006c006c00200000001000000020000000000000004c00'
                              '6f006700660069006c00650000002c00000010000000280000000400000048006900670068006c0069006700'
                              '68007400460047000000000000002c00000010000000280000000400000048006900670068006c0069006700'
                              '6800740042004700000080ffff007c00000010000000200000005c0000004c006f00670046006f006e007400'
                              '0000080000000000000000000000000000009001000000000000000000004d00530020005300680065006c00'
                              '6c00200044006c00670000000000000000000000000000000000000000000000000000000000000000000000'
                              '00000000000088000000100000002c0000005c00000042006f006f006f006b006d00610072006b0046006f00'
                              '6e007400000008000000000000000000000000000000bc02000000000000000000004d005300200053006800'
                              '65006c006c00200044006c006700000000000000000000000000000000000000000000000000000000000000'
                              '000000000000000000002e000000100000002a0000000400000041006400760061006e006300650064004d00'
                              '6f00640065000000000000002a0000001000000026000000040000004100750074006f007300630072006f00'
                              '6c006c000000000000002e000000100000002a0000000400000048006900730074006f007200790044006500'
                              '7000740068000000c800000028000000100000002400000004000000500072006f00660069006c0069006e00'
                              '6700000000000000380000001000000034000000040000004400650073007400720075006300740069007600'
                              '6500460069006c007400650072000000010000002c00000010000000280000000400000041006c0077006100'
                              '790073004f006e0054006f007000000000000000360000001000000032000000040000005200650073006f00'
                              '6c00760065004100640064007200650073007300650073000000010000002600000010000000260000000000'
                              '000053006f007500720063006500500061007400680000008600000010000000260000006000000053007900'
                              '6d0062006f006c00500061007400680000007300720076002a00680074007400700073003a002f002f006d00'
                              '730064006c002e006d006900630072006f0073006f00660074002e0063006f006d002f0064006f0077006e00'
                              '6c006f00610064002f00730079006d0062006f006c0073000000000400001000000028000000d80300004600'
                              '69006c00740065007200520075006c006500730000000119000000759c000000000000011600000070007900'
                              '740068006f006e002e0065007800650000000000000000000000879c000006000000010800000070006d0063'
                              '0000000000000000000000759c0000000000000018000000500072006f0063006d006f006e002e0065007800'
                              '650000000000000000000000759c0000000000000018000000500072006f0063006500780070002e00650078'
                              '00650000000000000000000000759c000000000000001a0000004100750074006f00720075006e0073002e00'
                              '65007800650000000000000000000000759c000000000000001c000000500072006f0063006d006f006e0036'
                              '0034002e0065007800650000000000000000000000759c000000000000001c000000500072006f0063006500'
                              '78007000360034002e0065007800650000000000000000000000759c000000000000000e0000005300790073'
                              '00740065006d0000000000000000000000779c00000400000000100000004900520050005f004d004a005f00'
                              '00000000000000000000779c0000040000000010000000460041005300540049004f005f0000000000000000'
                              '000000789c00000400000000100000004600410053005400200049004f0000000000000000000000879c0000'
                              '05000000001a0000007000610067006500660069006c0065002e007300790073000000000000000000000087'
                              '9c000005000000000a00000024004d006600740000000000000000000000879c000005000000001200000024'
                              '004d00660074004d0069007200720000000000000000000000879c000005000000001200000024004c006f00'
                              '6700460069006c00650000000000000000000000879c0000050000000010000000240056006f006c0075006d'
                              '00650000000000000000000000879c0000050000000012000000240041007400740072004400650066000000'
                              '0000000000000000879c000005000000000c000000240052006f006f00740000000000000000000000879c00'
                              '0005000000001000000024004200690074006d006100700000000000000000000000879c000005000000000c'
                              '000000240042006f006f00740000000000000000000000879c00000500000000120000002400420061006400'
                              '43006c007500730000000000000000000000879c000005000000001000000024005300650063007500720065'
                              '0000000000000000000000879c00000500000000100000002400550070004300610073006500000000000000'
                              '00000000879c0000060000000010000000240045007800740065006e00640000000000000000000000929c00'
                              '00000000000014000000500072006f00660069006c0069006e00670000000000000000000000330000001000'
                              '00002e0000000500000048006900670068006c006900670068007400520075006c0065007300000001000000'
                              '00')