MCPcopy Create free account
hub / github.com/rabbitstack/fibratus / RundownKey

Method RundownKey

pkg/event/event_windows.go:291–340  ·  view source on GitHub ↗

RundownKey calculates the rundown event hash. The hash is used to determine if the rundown event was already processed.

()

Source from the content-addressed store, hash-verified

289// RundownKey calculates the rundown event hash. The hash is
290// used to determine if the rundown event was already processed.
291func (e *Event) RundownKey() uint64 {
292 switch e.Type {
293 case ProcessRundown:
294 b := make([]byte, 4)
295 pid, _ := e.Params.GetPid()
296
297 binary.LittleEndian.PutUint32(b, pid)
298
299 return hashers.FnvUint64(b)
300 case ThreadRundown:
301 b := make([]byte, 8)
302 pid, _ := e.Params.GetPid()
303 tid, _ := e.Params.GetTid()
304
305 binary.LittleEndian.PutUint32(b, pid)
306 binary.LittleEndian.PutUint32(b, tid)
307
308 return hashers.FnvUint64(b)
309 case ModuleRundown:
310 pid, _ := e.Params.GetPid()
311 mod, _ := e.Params.GetString(params.ModulePath)
312 b := make([]byte, 4+len(mod))
313
314 binary.LittleEndian.PutUint32(b, pid)
315 b = append(b, mod...)
316
317 return hashers.FnvUint64(b)
318 case FileRundown:
319 b := make([]byte, 8)
320 fileObject, _ := e.Params.GetUint64(params.FileObject)
321 binary.LittleEndian.PutUint64(b, fileObject)
322
323 return hashers.FnvUint64(b)
324 case MapFileRundown:
325 b := make([]byte, 12)
326 fileKey, _ := e.Params.GetUint64(params.FileKey)
327 binary.LittleEndian.PutUint32(b, e.PID)
328 binary.LittleEndian.PutUint64(b, fileKey)
329
330 return hashers.FnvUint64(b)
331 case RegKCBRundown:
332 key, _ := e.Params.GetString(params.RegPath)
333 b := make([]byte, 4+len(key))
334
335 binary.LittleEndian.PutUint32(b, e.PID)
336 b = append(b, key...)
337 return hashers.FnvUint64(b)
338 }
339 return 0
340}
341
342// PartialKey computes the unique hash of the event
343// that can be employed to determine if the event

Callers 2

IsRundownProcessedMethod · 0.95

Calls 5

FnvUint64Function · 0.92
GetPidMethod · 0.80
GetTidMethod · 0.80
GetUint64Method · 0.80
GetStringMethod · 0.45

Tested by 1