# Path: nitro/backends/windows/types.py
# class ObjectAttributes(WinStruct):
#     __slots__ = (
#         'Length',
#         'RootDirectory',
#         'ObjectName',
#     )
# 
#     _fields_ = [
#         (0, 'Length', 'I'),
#         (0x8, 'RootDirectory', 'P'),
#         (0x10, 'ObjectName', 'P'),
#     ]
# 
#     def __init__(self, addr, process):
#         super().__init__(addr, process)
#         if self.Length != 0x30:
#             # memory inconsistent
#             raise InconsistentMemoryError()
#         self.ObjectName = UnicodeString(self.ObjectName, process)
# 
# class FileAccessMask(AccessMask):
#     SPECIFIC_RIGHTS = [
#         (1 << 0, "FILE_READ_DATA"),
#         (1 << 1, "FILE_WRITE_DATA"),
#         (1 << 2, "FILE_APPEND_DATA"),
#         (1 << 3, "FILE_READ_EA"),
#         (0x10, "FILE_WRITE_EA"),
#         (0x20, "FILE_EXECUTE"),
#         (0x80, "FILE_READ_ATTRIBUTES"),
#         (0x100, "FILE_WRITE_ATTRIBUTES"),
#     ]
# 
#     def __init__(self, desired_access):
#         super().__init__(desired_access)
#         self.rights.extend([right for mask, right in self.SPECIFIC_RIGHTS if
#                             desired_access & mask])


import os
import sys
import unittest
import logging
import json
from layers import VMLayer
from vmtest_helper import WindowsVMTestHelper
from nitro.backends.windows.types import ObjectAttributes, FileAccessMask
        logging.debug('Writing events...')
        with open('events.json', 'w') as f:
            json.dump(events, f, indent=4)
        logging.info('Test execution time {}'.format(exec_time))
        # checking if we find the event where the file is opened
        event_found = [e for e in events if e.get('hook')
                       and e['hook']['object_name'].find('foobar.txt') != -1
                       and 'FILE_WRITE_DATA' in e['hook']['access']]
        self.assertTrue(event_found)

    def test_deletefile(self):
        binary_path = os.path.join(self.script_dir, 'binaries', 'delete_file.exe')
        self.vm.cdrom.set_executable(binary_path)

        def enter_NtOpenFile(syscall, backend):
            DesiredAccess = syscall.args[1]
            object_attributes = syscall.args[2]
            obj = ObjectAttributes(object_attributes, syscall.process)
            buffer = obj.ObjectName.Buffer
            access = FileAccessMask(DesiredAccess)
            syscall.hook = {
                'object_name': buffer,
                'access': access.rights
            }

        def enter_NtCreateFile(syscall, backend):
            DesiredAccess = syscall.args[1]
            object_attributes = syscall.args[2]
            obj = ObjectAttributes(object_attributes, syscall.process)
            buffer = obj.ObjectName.Buffer

# Path: nitro/backends/windows/types.py
# class ObjectAttributes(WinStruct):
#     __slots__ = (
#         'Length',
#         'RootDirectory',
#         'ObjectName',
#     )
# 
#     _fields_ = [
#         (0, 'Length', 'I'),
#         (0x8, 'RootDirectory', 'P'),
#         (0x10, 'ObjectName', 'P'),
#     ]
# 
#     def __init__(self, addr, process):
#         super().__init__(addr, process)
#         if self.Length != 0x30:
#             # memory inconsistent
#             raise InconsistentMemoryError()
#         self.ObjectName = UnicodeString(self.ObjectName, process)
# 
# class FileAccessMask(AccessMask):
#     SPECIFIC_RIGHTS = [
#         (1 << 0, "FILE_READ_DATA"),
#         (1 << 1, "FILE_WRITE_DATA"),
#         (1 << 2, "FILE_APPEND_DATA"),
#         (1 << 3, "FILE_READ_EA"),
#         (0x10, "FILE_WRITE_EA"),
#         (0x20, "FILE_EXECUTE"),
#         (0x80, "FILE_READ_ATTRIBUTES"),
#         (0x100, "FILE_WRITE_ATTRIBUTES"),
#     ]
# 
#     def __init__(self, desired_access):
#         super().__init__(desired_access)
#         self.rights.extend([right for mask, right in self.SPECIFIC_RIGHTS if
#                             desired_access & mask])


# Path: tests/test_windows.py
import os
import sys
import unittest
import logging
import json
from layers import VMLayer
from vmtest_helper import WindowsVMTestHelper
from nitro.backends.windows.types import ObjectAttributes, FileAccessMask

        logging.debug('Writing events...')
        with open('events.json', 'w') as f:
            json.dump(events, f, indent=4)
        logging.info('Test execution time {}'.format(exec_time))
        # checking if we find the event where the file is opened
        event_found = [e for e in events if e.get('hook')
                       and e['hook']['object_name'].find('foobar.txt') != -1
                       and 'FILE_WRITE_DATA' in e['hook']['access']]
        self.assertTrue(event_found)

    def test_deletefile(self):
        binary_path = os.path.join(self.script_dir, 'binaries', 'delete_file.exe')
        self.vm.cdrom.set_executable(binary_path)

        def enter_NtOpenFile(syscall, backend):
            DesiredAccess = syscall.args[1]
            object_attributes = syscall.args[2]
            obj = ObjectAttributes(object_attributes, syscall.process)
            buffer = obj.ObjectName.Buffer
            access = FileAccessMask(DesiredAccess)
            syscall.hook = {
                'object_name': buffer,
                'access': access.rights
            }

        def enter_NtCreateFile(syscall, backend):
            DesiredAccess = syscall.args[1]
            object_attributes = syscall.args[2]
            obj = ObjectAttributes(object_attributes, syscall.process)
            buffer = obj.ObjectName.Buffer

            access = FileAccessMask(DesiredAccess)