Method ProcessEvent

internal/etw/processors/mem_windows.go:50–77

(e *event.Event)

}

func (m memProcessor) ProcessEvent(e *event.Event) (*event.Event, bool, error) {
	if e.Category == event.Mem {
		pid := e.Params.MustGetPid()
		if e.IsVirtualAlloc() {
			// retrieve info about the range of pages and enrich the event
			// with allocation protection options and the type of pages in
			// the allocated region. If the region is mapped, we try to find
			// the backing file name
			addr := e.Params.MustGetUint64(params.MemBaseAddress)
			region := m.regionProber.Query(pid, addr)
			if region != nil {
				if region.IsMapped() {
					e.AppendParam(params.FilePath, params.DOSPath, region.GetMappedFile())
				}
				e.AppendEnum(params.MemPageType, region.Type, MemPageTypes)
				e.AppendFlags(params.MemProtect, region.Protect, event.MemProtectionFlags)
				e.AppendParam(params.MemProtectMask, params.AnsiString, region.ProtectMask())
			}
		}
		proc := m.psnap.FindAndPut(pid)
		if proc != nil {
			e.AppendParam(params.Exe, params.Path, proc.Exe)
			e.AppendParam(params.ProcessName, params.AnsiString, proc.Name)
		}
		return e, false, nil
	}
	return e, true, nil
}