getFileInfo obtains the file information for created files and loaded modules. Appends the file data to the event parameters, so subsequent field extractions will already have the needed info.
(f fields.Field, e *event.Event)
| 78 | // Appends the file data to the event parameters, so subsequent field extractions |
| 79 | // will already have the needed info. |
| 80 | func getFileInfo(f fields.Field, e *event.Event) (params.Value, error) { |
| 81 | switch f { |
| 82 | case fields.FileIsDLL, fields.ImageIsDLL, fields.ModuleIsDLL: |
| 83 | if e.Params.Contains(params.FileIsDLL) { |
| 84 | return e.Params.GetBool(params.FileIsDLL) |
| 85 | } |
| 86 | case fields.FileIsDriver, fields.ModuleIsDriver, fields.ImageIsDriver: |
| 87 | if e.Params.Contains(params.FileIsDriver) { |
| 88 | return e.Params.GetBool(params.FileIsDriver) |
| 89 | } |
| 90 | case fields.FileIsExecutable, fields.ImageIsExecutable, fields.ModuleIsExecutable: |
| 91 | if e.Params.Contains(params.FileIsExecutable) { |
| 92 | return e.Params.GetBool(params.FileIsExecutable) |
| 93 | } |
| 94 | case fields.ImageIsDotnet, fields.ModuleIsDotnet, fields.DllIsDotnet: |
| 95 | if e.Params.Contains(params.FileIsDotnet) { |
| 96 | return e.Params.GetBool(params.FileIsDotnet) |
| 97 | } |
| 98 | } |
| 99 | |
| 100 | fileinfo, err := fs.GetFileInfo(e.GetParamAsString(params.FilePath)) |
| 101 | if err != nil { |
| 102 | return nil, err |
| 103 | } |
| 104 | |
| 105 | e.AppendParam(params.FileIsDLL, params.Bool, fileinfo.IsDLL) |
| 106 | e.AppendParam(params.FileIsDriver, params.Bool, fileinfo.IsDriver) |
| 107 | e.AppendParam(params.FileIsExecutable, params.Bool, fileinfo.IsExecutable) |
| 108 | e.AppendParam(params.FileIsDotnet, params.Bool, fileinfo.IsDotnet) |
| 109 | |
| 110 | switch f { |
| 111 | case fields.FileIsDLL, fields.ImageIsDLL, fields.ModuleIsDLL: |
| 112 | return fileinfo.IsDLL, nil |
| 113 | case fields.FileIsDriver, fields.ModuleIsDriver, fields.ImageIsDriver: |
| 114 | return fileinfo.IsDriver, nil |
| 115 | case fields.FileIsExecutable, fields.ImageIsExecutable, fields.ModuleIsExecutable: |
| 116 | return fileinfo.IsExecutable, nil |
| 117 | case fields.ImageIsDotnet, fields.ModuleIsDotnet, fields.DllIsDotnet: |
| 118 | return fileinfo.IsDotnet, nil |
| 119 | } |
| 120 | |
| 121 | return nil, fmt.Errorf("unexpected field: %s", f) |
| 122 | } |
| 123 | |
| 124 | // getSignature tries to find the module signature mapped to the given address. |
| 125 | // If the signature is not found in the cache, then a fresh signature instance |