예제 #1
2
func GetProcessNameMap() map[uint32]string {
	defer metrics("GetProcessNameMap")(time.Now())
	snapshot, err := syscall.CreateToolhelp32Snapshot(syscall.TH32CS_SNAPPROCESS, 0)
	if err != nil {
		common.Error("Fail to syscall CreateToolhelp32Snapshot: %v", err)
		return nil
	}
	defer syscall.CloseHandle(snapshot)
	var procEntry syscall.ProcessEntry32
	procEntry.Size = uint32(unsafe.Sizeof(procEntry))
	if err = syscall.Process32First(snapshot, &procEntry); err != nil {
		common.Error("Fail to syscall Process32First: %v", err)
		return nil
	}
	processNameMap := make(map[uint32]string)
	for {
		processNameMap[procEntry.ProcessID] = parseProcessName(procEntry.ExeFile)
		if err = syscall.Process32Next(snapshot, &procEntry); err != nil {
			if err == syscall.ERROR_NO_MORE_FILES {
				return processNameMap
			}
			common.Error("Fail to syscall Process32Next: %v", err)
			return nil
		}
	}
}
예제 #2
0
// re-implementation of private function in https://github.com/golang/go/blob/master/src/syscall/syscall_windows.go#L945
func getProcessEntry(pid int) (pe *syscall.ProcessEntry32, err error) {
	snapshot, err := syscall.CreateToolhelp32Snapshot(syscall.TH32CS_SNAPPROCESS, 0)
	if err != nil {
		return nil, err
	}
	defer syscall.CloseHandle(syscall.Handle(snapshot))

	var processEntry syscall.ProcessEntry32
	processEntry.Size = uint32(unsafe.Sizeof(processEntry))
	err = syscall.Process32First(snapshot, &processEntry)
	if err != nil {
		return nil, err
	}

	for {
		if processEntry.ProcessID == uint32(pid) {
			pe = &processEntry
			return
		}

		err = syscall.Process32Next(snapshot, &processEntry)
		if err != nil {
			return nil, err
		}
	}
}
예제 #3
0
파일: kernel32.go 프로젝트: Xustyx/w32
func Process32Next(snapshot HANDLE, procEntry *PROCESSENTRY32) (err error) {
	_snapshot := syscall.Handle(snapshot)
	//var _procEntry *syscall.ProcessEntry32

	err = syscall.Process32Next(_snapshot, (*syscall.ProcessEntry32)(procEntry))

	//procEntry = PROCESSENTRY32(*_procEntry)

	return
}
예제 #4
0
// loadProcessMap returns a map of processes and their children.
func loadProcessMap() (map[uint32][]uint32, error) {
	snapshot, err := syscall.CreateToolhelp32Snapshot(syscall.TH32CS_SNAPPROCESS, 0)
	if err != nil {
		return nil, err
	}
	defer syscall.CloseHandle(snapshot)

	var proc syscall.ProcessEntry32
	proc.Size = uint32(unsafe.Sizeof(proc))
	if err := syscall.Process32First(snapshot, &proc); err != nil {
		return nil, err
	}

	parentMap := make(map[uint32][]uint32)
	for {
		parentMap[proc.ParentProcessID] = append(parentMap[proc.ParentProcessID], proc.ProcessID)
		if err := syscall.Process32Next(snapshot, &proc); err != nil {
			if errNo, ok := err.(syscall.Errno); ok && errNo == syscall.ERROR_NO_MORE_FILES {
				return parentMap, nil
			}
			return nil, err
		}
	}
}