Function MemoryAnalysisRoutine

procsmemory.go:26–67

MemoryAnalysisRoutine analyse processes memory every 5 seconds

(pDump string, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, pInfiniteLoop bool, rules *yara.Rules)

// MemoryAnalysisRoutine analyse processes memory every 5 seconds
func MemoryAnalysisRoutine(pDump string, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, pInfiniteLoop bool, rules *yara.Rules) {
	for {
		// list process information and memory
		procs := ListProcess(pVerbose)

		// analyze process memory and executable
		for _, proc := range procs {
			// dump processes memory and quit the program
			if len(pDump) > 0 {
				if err := WriteProcessMemoryToFile(pDump, proc.ProcessName+fmt.Sprint(proc.PID)+".dmp", proc.MemoryDump); err != nil && pVerbose {
					logMessage(LOG_ERROR, "[ERROR]", err)
				}
			}

			// parsing kill queue
			if StringInSlice(proc.ProcessPath, killQueue) && pKill {
				logMessage(LOG_INFO, "[INFO]", "KILLING PID", proc.PID)
				KillProcessByID(proc.PID, pVerbose)
			} else {
				// analyzing process memory and cleaning memory buffer
				MemoryAnalysis(&proc, pQuarantine, pKill, pNotifications, pVerbose, rules)
				proc.MemoryDump = nil

				// analyzing process executable
				FileAnalysis(proc.ProcessPath, pQuarantine, pKill, pNotifications, pVerbose, rules, "MEMORY")
			}
		}

		if len(pDump) > 0 {
			logMessage(LOG_INFO, "[INFO] Processes memory dump completed - Exiting program.")
			os.Exit(0)
		}

		killQueue = nil
		if !pInfiniteLoop {
			wg.Done()
			break
		} else {
			time.Sleep(5 * time.Second)
		}
	}
}

// ListProcess try to get all running processes and dump their memory, return a ProcessInformation slice
func ListProcess(verbose bool) (procsInfo []ProcessInformation) {