Method updateSnapshotters

pkg/cap/reader_windows.go:180–220

(evt *event.Event)

}

func (r *reader) updateSnapshotters(evt *event.Event) error {
	switch evt.Type {
	case event.TerminateProcess:
		if err := r.psnapshotter.Remove(evt); err != nil {
			return err
		}
	case event.TerminateThread:
		pid := evt.Params.MustGetPid()
		tid := evt.Params.MustGetTid()
		if err := r.psnapshotter.RemoveThread(pid, tid); err != nil {
			return err
		}
	case event.UnloadModule:
		pid := evt.Params.MustGetPid()
		addr := evt.Params.TryGetAddress(params.ModuleBase)
		if err := r.psnapshotter.RemoveModule(pid, addr); err != nil {
			return err
		}
	case event.CreateProcess,
		event.ProcessRundown,
		event.LoadModule,
		event.ModuleRundown,
		event.CreateThread,
		event.ThreadRundown:
		if err := r.psnapshotter.WriteFromCapture(evt); err != nil {
			return err
		}
	case event.CreateHandle:
		if err := r.hsnapshotter.Write(evt); err != nil {
			return err
		}
	case event.CloseHandle:
		if err := r.hsnapshotter.Remove(evt); err != nil {
			return err
		}
	}
	if evt.PS == nil {
		_, evt.PS = r.psnapshotter.Find(evt.PID)
	}
	return nil
}

func (r *reader) RecoverSnapshotters() (handle.Snapshotter, ps.Snapshotter, error) {
	hsnap, err := r.recoverHandleSnapshotter()