Extra tests

Signed-off-by: Alan Jowett (from Dev Box) <[email protected]>
microsoft · Mar 1, 2024 · da4bd0e · da4bd0e
1 parent e5fd497
commit da4bd0e
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/tests/netebpfext_unit/netebpfext_unit.cpp b/tests/netebpfext_unit/netebpfext_unit.cpp
@@ -955,6 +955,13 @@ TEST_CASE("process_invoke", "[netebpfext]")
     REQUIRE((HANDLE)client_context.process_context.creating_thread_id == create_info.CreatingThreadId.UniqueThread);
     REQUIRE(create_info.CreationStatus == STATUS_ACCESS_DENIED);
     REQUIRE(client_context.process_context.operation == PROCESS_OPERATION_CREATE);
+
+    // Test process termination.
+    // Just verify that it doesn't crash.
+    usersime_invoke_process_creation_notify_routine(reinterpret_cast<PEPROCESS>(&fake_eprocess), (HANDLE)1, nullptr);
+
+    REQUIRE(client_context.process_context.process_id == 1);
+    REQUIRE(client_context.process_context.operation == PROCESS_OPERATION_DELETE);
 }
 
 #pragma endregion process