refactor(windows): split Windows code into winapi (#575)

utils/injector/pe_windows_test.go

@@ -0,0 +1,106 @@
+//go:build windows
+
+package injector
+
+import (
+	"os"
+	"testing"
+)
+
+// kernel32Path is always present on a Windows host and its export table
+// is stable across versions — an ideal fixture for PE-parsing tests.
+const kernel32Path = `C:\Windows\System32\kernel32.dll`
+
+func readKernel32(t *testing.T) []byte {
+	t.Helper()
+	data, err := os.ReadFile(kernel32Path)
+	if err != nil {
+		t.Fatalf("read %s: %v", kernel32Path, err)
+	}
+	if len(data) == 0 {
+		t.Fatalf("%s is empty", kernel32Path)
+	}
+	return data
+}
+
+func TestDetectPEArch_Kernel32IsAMD64(t *testing.T) {
+	arch, err := DetectPEArch(readKernel32(t))
+	if err != nil {
+		t.Fatalf("DetectPEArch: %v", err)
+	}
+	if arch != ArchAMD64 {
+		t.Errorf("expected %q, got %q", ArchAMD64, arch)
+	}
+}
+
+func TestDetectPEArch_Garbage(t *testing.T) {
+	_, err := DetectPEArch([]byte("definitely not a PE file"))
+	if err == nil {
+		t.Error("expected parse error for non-PE input")
+	}
+}
+
+func TestDetectPEArch_EmptyInput(t *testing.T) {
+	_, err := DetectPEArch(nil)
+	if err == nil {
+		t.Error("expected parse error for empty input")
+	}
+}
+
+// TestFindExportFileOffset_KnownExports walks a handful of kernel32 exports
+// that Bootstrap also relies on via pre-resolved import patching. Passing
+// here means both the export-table walker and the RVA→file-offset converter
+// work against a real Windows PE — not just against fixtures we control.
+func TestFindExportFileOffset_KnownExports(t *testing.T) {
+	data := readKernel32(t)
+
+	// All of these have been stable kernel32 exports since Windows XP.
+	exports := []string{
+		"LoadLibraryA",
+		"GetProcAddress",
+		"VirtualAlloc",
+		"VirtualProtect",
+		"CreateFileW",
+	}
+
+	for _, name := range exports {
+		off, err := FindExportFileOffset(data, name)
+		if err != nil {
+			t.Errorf("%s: unexpected error: %v", name, err)
+			continue
+		}
+		if off == 0 {
+			t.Errorf("%s: got zero file offset", name)
+		}
+		if int(off) >= len(data) {
+			t.Errorf("%s: offset %d exceeds file size %d", name, off, len(data))
+		}
+	}
+}
+
+func TestFindExportFileOffset_MissingExport(t *testing.T) {
+	data := readKernel32(t)
+	_, err := FindExportFileOffset(data, "HbdNoSuchExport_abcdef1234")
+	if err == nil {
+		t.Error("expected error for nonexistent export name")
+	}
+}
+
+func TestFindExportFileOffset_GarbageInput(t *testing.T) {
+	_, err := FindExportFileOffset([]byte("not a PE file at all"), "LoadLibraryA")
+	if err == nil {
+		t.Error("expected error when parsing non-PE input")
+	}
+}
+
+func TestFindExportFileOffset_TruncatedPE(t *testing.T) {
+	data := readKernel32(t)
+	// Chop to just the DOS stub — export directory is unreachable.
+	if len(data) < 128 {
+		t.Fatalf("kernel32 is implausibly small: %d bytes", len(data))
+	}
+	_, err := FindExportFileOffset(data[:128], "LoadLibraryA")
+	if err == nil {
+		t.Error("expected error when PE is truncated past the DOS header")
+	}
+}