Method ProcessEvent

internal/etw/processors/ps_windows.go:42–85

(e *event.Event)

}

func (p psProcessor) ProcessEvent(e *event.Event) (*event.Event, bool, error) {
	switch e.Type {
	case event.CreateProcess, event.CreateProcessInternal, event.TerminateProcess, event.ProcessRundown, event.ProcessRundownInternal:
		evt, err := p.processEvent(e)
		if evt.IsTerminateProcess() {
			p.regionProber.Remove(evt.Params.MustGetPid())
			return evt, false, multierror.Wrap(err, p.psnap.Remove(evt))
		}

		return evt, false, multierror.Wrap(err, p.psnap.Write(evt))
	case event.CreateThread, event.TerminateThread, event.ThreadRundown:
		pid, err := e.Params.GetPid()
		if err != nil {
			return e, false, err
		}
		proc := p.psnap.FindAndPut(pid)
		if proc != nil {
			e.AppendParam(params.Exe, params.UnicodeString, proc.Exe)
		}
		if !e.IsTerminateThread() {
			return e, false, p.psnap.AddThread(e)
		}
		tid, err := e.Params.GetTid()
		if err != nil {
			return e, false, err
		}

		return e, false, p.psnap.RemoveThread(pid, tid)
	case event.OpenProcess, event.OpenThread:
		pid, err := e.Params.GetPid()
		if err != nil {
			return e, false, err
		}
		proc := p.psnap.FindAndPut(pid)
		if proc != nil {
			e.AppendParam(params.Exe, params.Path, proc.Exe)
			e.AppendParam(params.ProcessName, params.AnsiString, proc.Name)
		}

		return e, false, nil
	}

	return e, true, nil
}

//nolint:unparam
func (p psProcessor) processEvent(e *event.Event) (*event.Event, error) {