ps

Documentation

Overview

Package ps contains process's state snapshotter implementation.

Index

• type Snapshotter
• type SnapshotterMock
  • func (s *SnapshotterMock) Close() error
  • func (s *SnapshotterMock) Find(pid uint32) *pstypes.PS
  • func (s *SnapshotterMock) GetSnapshot() []*pstypes.PS
  • func (s *SnapshotterMock) Remove(kevt *kevent.Kevent) error
  • func (s *SnapshotterMock) Size() uint32
  • func (s *SnapshotterMock) Write(kevt *kevent.Kevent) error
  • func (s *SnapshotterMock) WriteFromKcap(kevt *kevent.Kevent) error

Types

type Snapshotter

type Snapshotter interface {
	// Write appends a new process state to the snapshotter. It takes as an input the inbound kernel event to fetch
	// the basic data, but also enriches the process' state with extra metadata such as process' env variables, PE
	// metadata for Windows binaries and so on.
	Write(kevt *kevent.Kevent) error
	// WriteFromKcap appends a new process state to the snapshotter from the captured kernel event.
	WriteFromKcap(kevt *kevent.Kevent) error
	// Remove deletes process's state from the snapshotter.
	Remove(kevt *kevent.Kevent) error
	// Find attempts to retrieve process' state for the specified process identifier.
	Find(pid uint32) *pstypes.PS
	// Size returns the total number of process state items.
	Size() uint32
	// Close closes process snapshotter and disposes all allocated resources.
	Close() error
}

Snapshotter is the interface that exposes a set of methods all process snapshotters have to satisfy. It stores the state of all running processes in the system including its threads, dynamically referenced libraries, handles/file descriptors and other metadata.

type SnapshotterMock

type SnapshotterMock struct {
	mock.Mock
}

SnapshotterMock is the process snapshotter mock used in tests.

func (*SnapshotterMock) Close

func (s *SnapshotterMock) Close() error

Close method

func (*SnapshotterMock) Find

func (s *SnapshotterMock) Find(pid uint32) *pstypes.PS

Find method

func (*SnapshotterMock) GetSnapshot

func (s *SnapshotterMock) GetSnapshot() []*pstypes.PS

GetSnapshot method

func (*SnapshotterMock) Remove

func (s *SnapshotterMock) Remove(kevt *kevent.Kevent) error

Remove method

func (*SnapshotterMock) Size

func (s *SnapshotterMock) Size() uint32

Size method

func (*SnapshotterMock) Write

func (s *SnapshotterMock) Write(kevt *kevent.Kevent) error

Write method

func (*SnapshotterMock) WriteFromKcap

func (s *SnapshotterMock) WriteFromKcap(kevt *kevent.Kevent) error

WriteFromKcap method