Function format_proc_strings

src/os/linux/strings_search.cpp:331–356

}

ByteBuf format_proc_strings(const Engine& eng, const Process& p) {
    StringExtractStats stats{};
    auto hits = extract_strings(eng, p, /*min_len=*/6, /*max_hits=*/0, &stats);
    std::string out;
    out.reserve(std::min<std::size_t>(64 * 1024 + hits.size() * 64, 8 * 1024 * 1024));
    out += fmt::format(
        "# /proc/{}/strings.txt - printable ASCII strings (>=6 chars) from the\n"
        "# readable VMAs of pid {} ({}).\n"
        "# Scan order is by forensic interest: heap / stack / anonymous data and\n"
        "# anon-executable (commands, env, secrets, injected code) FIRST, then\n"
        "# file-backed regions, read-only library code LAST.\n"
        "# limit: none; oversized VMA guard: > 256 MiB skipped.\n"
        "# {} strings extracted; {} VMA(s) scanned; {} oversized VMA(s) skipped\n"
        "# ({} bytes); {} unreadable page/range skip(s).\n"
        "#\n"
        "# vma_start          hit_va            string\n"
        "# ----------------+----------------+----------\n",
        p.pid, p.pid, p.comm, hits.size(), stats.scanned_vmas,
        stats.skipped_oversized_vmas, stats.skipped_oversized_bytes,
        stats.unreadable_ranges);
    for (const auto& h : hits) {
        out += fmt::format("{:#016x}  {:#016x}  {}\n",
                           h.vma_start, h.hit_va, h.text);
    }
    return ByteBuf(out.begin(), out.end());
}
ByteBuf format_global_iocs(const Engine& eng) {
    // Per-process IOC scan with global hit cap so output stays bounded
    // even on a dump with thousands of processes.