Function build_proc_tree

src/vfs/proc_module.cpp:100–311

} // anonymous

NodePtr build_proc_tree(const std::vector<linux::Process>&  procs,
                        const PhysicalLayer&                phys,
                        const x86_64::PageTable&            /*kern_pt*/,
                        const IsfSymbols&                   isf,
                        const linux::KernelContext&         kctx,
                        const Engine&                       eng)
{
    auto root = std::make_shared<DirNode>("proc");

    for (const auto& p : procs) {
        auto ctx = std::make_shared<ProcCtx>(ProcCtx{ &phys, &isf, &kctx, &eng, p });
        auto folder_name = fmt::format("{}-{}", p.pid, sanitize(p.comm));
        auto dir = std::make_shared<DirNode>(folder_name);

        // Forensic warming is scoped to real user processes. Kernel threads
        // (mm == 0) have no address space / open files, so warming their
        // per-task files is mostly pointless work — tag those as cheap so the
        // warmer skips them. Files that only exist when mm != 0 (malfind,
        // entropy, yara, …) already can't appear for kernel threads.
        const FileCost procWarm = (p.mm != 0) ? kPerProc : FileCost{};

        // info.txt — populated lazily so VMA enumeration only happens on first read.
        dir->add(std::make_shared<LazyFileNode>("info.txt", [ctx]() {
            std::size_t vma_count = 0;
            u64 user_bytes = 0;
            if (ctx->p.mm) {
                auto vmas = linux::enumerate_vmas(*ctx->phys, *ctx->isf, *ctx->kctx, ctx->p);
                vma_count = vmas.size();
                for (auto& v : vmas) user_bytes += v.size();
            }
            return make_info_txt(ctx->p, vma_count, user_bytes);
        }));

        // memmap.txt — our pretty VMA table (kept for human-readable view).
        dir->add(std::make_shared<LazyFileNode>("memmap.txt", [ctx]() {
            if (!ctx->p.mm) return ByteBuf{};
            auto vmas = linux::enumerate_vmas(*ctx->phys, *ctx->isf, *ctx->kctx, ctx->p);
            return make_memmap_txt(vmas);
        }));

        // ----- Per-process Linux-compatible files. Each one is lazy; they only touch
        // memory on first read.
        dir->add(std::make_shared<LazyFileNode>("cmdline", [ctx]() {
            return linux::gen_cmdline(*ctx->phys, *ctx->isf, *ctx->kctx, ctx->p);
        }));
        auto environ_node = std::make_shared<LazyFileNode>("environ", [ctx]() {
            return linux::gen_environ(*ctx->phys, *ctx->isf, *ctx->kctx, ctx->p);
        });
        dir->add(environ_node);
        dir->add(std::make_shared<LazyFileNode>("comm", [ctx]() {
            return linux::gen_comm(ctx->p);
        }));
        dir->add(std::make_shared<LazyFileNode>("maps", [ctx]() {
            if (!ctx->p.mm) return ByteBuf{};
            auto vmas = linux::enumerate_vmas(*ctx->phys, *ctx->isf, *ctx->kctx, ctx->p);
            return linux::gen_maps(vmas);
        }));
        dir->add(std::make_shared<LazyFileNode>("status", [ctx]() {