Method AddModule

pkg/ps/snapshotter_windows.go:240–284

(e *event.Event)

}

func (s *snapshotter) AddModule(e *event.Event) error {
	pid, err := e.Params.GetPid()
	if err != nil {
		return err
	}
	s.mu.Lock()
	defer s.mu.Unlock()

	if pid == 0 && e.IsModuleRundown() {
		// assume system process if pid is zero
		pid = SystemPID
	}
	proc, ok := s.procs[pid]
	if !ok {
		return nil
	}

	module := pstypes.Module{}
	module.Size, _ = e.Params.GetUint64(params.ModuleSize)
	module.Checksum, _ = e.Params.GetUint32(params.ModuleCheckSum)
	module.Name = e.GetParamAsString(params.ModulePath)
	module.BaseAddress = e.Params.TryGetAddress(params.ModuleBase)
	module.DefaultBaseAddress = e.Params.TryGetAddress(params.ModuleDefaultBase)

	if e.IsLoadModuleInternal() {
		proc.AddModule(module)
		return nil
	}

	moduleCount.Add(1)

	module.SignatureLevel, _ = e.Params.GetUint32(params.ModuleSignatureLevel)
	module.SignatureType, _ = e.Params.GetUint32(params.ModuleSignatureType)

	if strings.EqualFold(proc.Name, filepath.Base(module.Name)) && len(proc.Exe) < len(module.Name) {
		// if the module is loaded for the process executable, and
		// we don't have the full executable path, override with
		// the one from the Module path
		proc.Exe = module.Name
	}

	proc.AddModule(module)

	return nil
}

func (s *snapshotter) RemoveThread(pid uint32, tid uint32) error {
	s.mu.Lock()