| 450 | } |
| 451 | |
| 452 | func BenchmarkEventMarshalJSONStdlib(b *testing.B) { |
| 453 | evt := &Event{ |
| 454 | Type: CreateFile, |
| 455 | Tid: 2484, |
| 456 | PID: 859, |
| 457 | CPU: 1, |
| 458 | Seq: 2, |
| 459 | Name: "CreateFile", |
| 460 | Timestamp: time.Now(), |
| 461 | Category: File, |
| 462 | Host: "archrabbit", |
| 463 | Description: "Creates or opens a new file, directory, I/O device, pipe, console", |
| 464 | Params: Params{ |
| 465 | params.FileObject: {Name: params.FileObject, Type: params.Uint64, Value: uint64(12456738026482168384)}, |
| 466 | params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: "\\Device\\HarddiskVolume2\\Windows\\system32\\user32.dll"}, |
| 467 | params.FileType: {Name: params.FileType, Type: params.AnsiString, Value: "file"}, |
| 468 | params.FileOperation: {Name: params.FileOperation, Type: params.AnsiString, Value: "open"}, |
| 469 | params.BasePrio: {Name: params.BasePrio, Type: params.Int8, Value: int8(2)}, |
| 470 | params.PagePrio: {Name: params.PagePrio, Type: params.Uint8, Value: uint8(2)}, |
| 471 | }, |
| 472 | Metadata: map[MetadataKey]any{"foo": "bar", "fooz": "baarz"}, |
| 473 | PS: &pstypes.PS{ |
| 474 | PID: 2436, |
| 475 | Ppid: 6304, |
| 476 | Name: "firefox.exe", |
| 477 | Exe: `C:\Program Files\Mozilla Firefox\firefox.exe`, |
| 478 | Cmdline: `C:\Program Files\Mozilla Firefox\firefox.exe -contentproc --channel="6304.3.1055809391\1014207667" -childID 1 -isForBrowser -prefsHandle 2584 -prefMapHandle 2580 -prefsLen 70 -prefMapSize 216993 -parentBuildID 20200107212822 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 6304 "\\.\pipe\gecko-crash-server-pipe.6304" 2596 tab`, |
| 479 | Cwd: `C:\Program Files\Mozilla Firefox\`, |
| 480 | SID: "archrabbit\\SYSTEM", |
| 481 | Args: []string{"-contentproc", `--channel=6304.3.1055809391\1014207667`, "-childID", "1", "-isForBrowser", "-prefsHandle", "2584", "-prefMapHandle", "2580", "-prefsLen", "70", "-prefMapSize", "216993", "-parentBuildID"}, |
| 482 | SessionID: 4, |
| 483 | Envs: map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"}, |
| 484 | Handles: []htypes.Handle{ |
| 485 | {Num: windows.Handle(0xffffd105e9baaf70), |
| 486 | Name: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b677c565-6ca5-45d3-b618-736b4e09b036}`, |
| 487 | Type: "Key", |
| 488 | Object: 777488883434455544, |
| 489 | Pid: uint32(1023), |
| 490 | }, |
| 491 | { |
| 492 | Num: windows.Handle(0xffffd105e9adaf70), |
| 493 | Name: `\RPC Control\OLEA61B27E13E028C4EA6C286932E80`, |
| 494 | Type: "ALPC Port", |
| 495 | Pid: uint32(1023), |
| 496 | MD: &htypes.AlpcPortInfo{ |
| 497 | Seqno: 1, |
| 498 | Context: 0x0, |
| 499 | Flags: 0x0, |
| 500 | }, |
| 501 | Object: 457488883434455544, |
| 502 | }, |
| 503 | { |
| 504 | Num: windows.Handle(0xeaffd105e9adaf30), |
| 505 | Name: `C:\Users\bunny`, |
| 506 | Type: "File", |
| 507 | Pid: uint32(1023), |
| 508 | MD: &htypes.FileInfo{ |
| 509 | IsDirectory: true, |