ListProcess try to get all running processes and dump their memory, return a ProcessInformation slice
(verbose bool)
| 68 | |
| 69 | // ListProcess try to get all running processes and dump their memory, return a ProcessInformation slice |
| 70 | func ListProcess(verbose bool) (procsInfo []ProcessInformation) { |
| 71 | runningPID := os.Getpid() |
| 72 | |
| 73 | procsIds, bytesReturned, err := GetProcessesList() |
| 74 | if err != nil { |
| 75 | log.Fatal(err) |
| 76 | } |
| 77 | for i := uint32(0); i < bytesReturned; i++ { |
| 78 | if procsIds[i] != 0 && procsIds[i] != uint32(runningPID) { |
| 79 | procHandle, err := GetProcessHandle(procsIds[i], windows.PROCESS_QUERY_INFORMATION|windows.PROCESS_VM_READ) |
| 80 | if err != nil && verbose { |
| 81 | logMessage(LOG_ERROR, "[ERROR]", "PID", procsIds[i], err) |
| 82 | } |
| 83 | |
| 84 | if err == nil && procHandle > 0 { |
| 85 | if proc, memdump, err := GetProcessMemory(procsIds[i], procHandle, verbose); err != nil && verbose { |
| 86 | logMessage(LOG_ERROR, "[ERROR]", err) |
| 87 | } else { |
| 88 | if len(memdump) > 0 { |
| 89 | // return process memory only if it has changed since the last process scan |
| 90 | if !StringInSlice(fmt.Sprintf("%x", md5.Sum(memdump)), memoryHashHistory) { |
| 91 | proc.MemoryDump = memdump |
| 92 | procsInfo = append(procsInfo, proc) |
| 93 | memoryHashHistory = append(memoryHashHistory, fmt.Sprintf("%x", md5.Sum(memdump))) |
| 94 | } |
| 95 | } |
| 96 | } |
| 97 | |
| 98 | } |
| 99 | windows.CloseHandle(procHandle) |
| 100 | } |
| 101 | } |
| 102 | return procsInfo |
| 103 | } |
| 104 | |
| 105 | // GetProcessMemory return a process memory dump based on its handle |
| 106 | func GetProcessMemory(pid uint32, handle windows.Handle, verbose bool) (ProcessInformation, []byte, error) { |
no test coverage detected