mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
Zac Brown
c81c3c41f6
* - Make projects for Managed and Native example code. - Create a 'tests' directory. - Remove SampleCSharpKrabsExe as it is redundant with respect to the example code. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com> * - Add note about TYPEASSERT and NDEBUG compilation flags to README.md. - Add /W4 /WX compiler flags to NativeExample project. - vcxproj.filters updates based on VS magic. Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>
70 lines
2.1 KiB
C++
70 lines
2.1 KiB
C++
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
#include "CppUnitTest.h"
|
|
#include <krabs.hpp>
|
|
|
|
using namespace Microsoft::VisualStudio::CppUnitTestFramework;
|
|
|
|
namespace krabstests
|
|
{
|
|
TEST_CLASS(test_kernel_providers)
|
|
{
|
|
public:
|
|
|
|
TEST_METHOD(should_be_instantiatable_compilation_test)
|
|
{
|
|
krabs::kernel_provider provider(EVENT_TRACE_FLAG_ALPC, krabs::guids::alpc);
|
|
krabs::kernel::thread_dispatch_provider cs;
|
|
}
|
|
|
|
TEST_METHOD(should_allow_event_registration)
|
|
{
|
|
krabs::kernel::thread_dispatch_provider cs;
|
|
cs.add_on_event_callback([](const EVENT_RECORD &) {});
|
|
}
|
|
|
|
TEST_METHOD(should_be_addable_to_a_kernel_trace)
|
|
{
|
|
krabs::kernel_trace trace;
|
|
krabs::kernel::thread_dispatch_provider cs;
|
|
trace.enable(cs);
|
|
}
|
|
|
|
TEST_METHOD(should_filter_kernel_events_by_guid)
|
|
{
|
|
bool calledAlpc = false;
|
|
bool calledImageLoad = false;
|
|
|
|
krabs::kernel_trace trace;
|
|
krabs::kernel::image_load_provider cs;
|
|
cs.add_on_event_callback([&](const EVENT_RECORD &) {
|
|
calledImageLoad = true;
|
|
});
|
|
trace.enable(cs);
|
|
|
|
krabs::kernel::alpc_provider ap;
|
|
ap.add_on_event_callback([&](const EVENT_RECORD &) {
|
|
calledAlpc = true;
|
|
});
|
|
trace.enable(ap);
|
|
|
|
krabs::testing::record_builder builder(
|
|
krabs::guids::image_load,
|
|
krabs::id(0),
|
|
krabs::version(3),
|
|
krabs::opcode(10));
|
|
|
|
builder.header().Flags = EVENT_HEADER_FLAG_CLASSIC_HEADER
|
|
| EVENT_HEADER_FLAG_64_BIT_HEADER
|
|
| EVENT_HEADER_FLAG_PROCESSOR_INDEX;
|
|
|
|
auto record = builder.pack_incomplete();
|
|
krabs::testing::kernel_trace_proxy proxy(trace);
|
|
proxy.push_event(record);
|
|
|
|
Assert::IsTrue(calledImageLoad);
|
|
Assert::IsFalse(calledAlpc);
|
|
}
|
|
};
|
|
} |