kbe
3f0bea6bd4
Implemented: - Core: UTF-16 ReadString boundary/alignment fix, target bitness and process id on MemoryBase - function interception: PatchManager, DetourManager, InstructionAnalyzer, MainThreadDispatcher - Execution: BackgroundTaskExecutor, InProcessInvoker - High-level: Magic facade, RemotePointer, async wrappers - Discovery/external code loading/Window groundwork (PEB/TEB, pattern scanning, raw allocations, DLL external code loading, window/input) Tests: 180 passing, 4 integration/interactive tests skipped.
29 lines
851 B
C#
29 lines
851 B
C#
using System.Diagnostics;
|
|
using WhiteMagic;
|
|
using WhiteMagic.ProcessEnvironment;
|
|
using Xunit;
|
|
|
|
namespace WhiteMagicTest.ProcessEnvironment;
|
|
|
|
public sealed class ManagedPebTests
|
|
{
|
|
[Fact]
|
|
public void Read_current_process_peb_fields_returns_plausible_values()
|
|
{
|
|
using var magic = Magic.OpenInProcess();
|
|
var peb = new ManagedPeb(magic.Memory);
|
|
|
|
Assert.NotEqual(IntPtr.Zero, peb.ReadPebAddress());
|
|
Assert.NotEqual(IntPtr.Zero, peb.ReadImageBaseAddress());
|
|
|
|
byte beingDebugged = peb.ReadBeingDebugged();
|
|
Assert.True(beingDebugged == 0 || beingDebugged == 1);
|
|
|
|
Assert.NotEqual(IntPtr.Zero, peb.ReadLdrAddress());
|
|
|
|
// The in-process test process is native to the host architecture, so
|
|
// it is not running under WOW64.
|
|
Assert.False(peb.ReadIsWow64Process());
|
|
}
|
|
}
|