| 107 | |
| 108 | |
| 109 | void EventProcessor::AnalyzeEventJson(nlohmann::json& j) { |
| 110 | try { |
| 111 | j["id"] = json_entries.size(); |
| 112 | j["trace_id"] = trace_id; |
| 113 | |
| 114 | // Sanity checks |
| 115 | if (!j.contains("type")) { |
| 116 | LOG_A(LOG_WARNING, "No type? %s", j.dump().c_str()); |
| 117 | return; |
| 118 | } |
| 119 | //if (!j.contains("pid")) { |
| 120 | // LOG_A(LOG_WARNING, "No pid? %s", j.dump().c_str()); |
| 121 | // return; |
| 122 | //} |
| 123 | |
| 124 | // Stats (for UI) |
| 125 | EventStats(j); |
| 126 | |
| 127 | // etw_pid is typically the source process of the event |
| 128 | if (j.contains("etw_pid") && !j["etw_pid"].is_null()) { |
| 129 | Process* process = g_ProcessResolver.getObject(j["etw_pid"].get<DWORD>()); |
| 130 | if (process == nullptr) { |
| 131 | // Should not happen |
| 132 | LOG_A(LOG_WARNING, "EventProcessor: Failed to get process object for pid %lu", j["etw_pid"].get<DWORD>()); |
| 133 | return; |
| 134 | } |
| 135 | |
| 136 | // Check if we need to gather the detailed information about the process |
| 137 | // If yes (not done before), do it and log it |
| 138 | if (!process->augmented) { |
| 139 | process->AugmentInfo(); |
| 140 | process->augmented = true; |
| 141 | LogInitialProcessInfo(process); |
| 142 | } |
| 143 | |
| 144 | // Augment the JSON Event with memory info |
| 145 | AugmentEventWithMemAddrInfo(j, process); |
| 146 | } |
| 147 | |
| 148 | // Print Event |
| 149 | PrintEvent(j); |
| 150 | |
| 151 | // Has to be at the end as we dont store reference |
| 152 | json_entries.push_back(j); |
| 153 | event_count++; |
| 154 | } |
| 155 | catch (const nlohmann::json::exception& e) { |
| 156 | LOG_A(LOG_ERROR, "JSON error in AnalyzeEventJson: %s", e.what()); |
| 157 | } |
| 158 | catch (const std::exception& e) { |
| 159 | LOG_A(LOG_ERROR, "Error in AnalyzeEventJson: %s", e.what()); |
| 160 | } |
| 161 | |
| 162 | return; |
| 163 | } |
| 164 | |
| 165 | |
| 166 | void EventProcessor::AnalyzeEventStr(std::string eventStr) { |
nothing calls this directly
no test coverage detected