@RequireTestImage
  def testDLLList(self):
    request = rdf_rekall_types.RekallRequest()
    request.plugins = [
        # Only use these methods for listing processes.
        rdf_rekall_types.PluginRequest(
            plugin="dlllist", args=dict(
                proc_regex="dumpit",
                method="PsActiveProcessHead"
            )),
    ]

    self.LaunchRekallPlugin(request)

    # Get the result collection - it should be a RekallResponseCollection.
    fd = aff4.FACTORY.Open(self.client_id.Add("analysis/memory"),
                           token=self.token)

    json_blobs = [x.json_messages for x in fd]
    json_blobs = "".join(json_blobs)

    for knownresult in ["DumpIt", "wow64win", "wow64", "wow64cpu", "ntdll"]:
      self.assertTrue(knownresult in json_blobs)
Tests that we can run a simple DLLList Action.
dataset/ETHPy150Open google/grr/grr/client/components/rekall_support/grr_rekall_test.py/RekallTests.testDLLList