Method Pop

pkg/event/stackwalk.go:115–170

Pop receives the stack walk event and pops the oldest originating event with the same pid,tid tuple formerly coined as stack identifier. The originating event is then decorated with callstack return addresses.

(e *Event)

// coined as stack identifier. The originating event is then
// decorated with callstack return addresses.
func (s *StackwalkDecorator) Pop(e *Event) *Event {
	s.mux.Lock()
	defer s.mux.Unlock()

	id := e.StackID()
	q, ok := s.buckets[id]
	if !ok {
		return e
	}

	var evt *Event
	if len(q) > 0 {
		evt, s.buckets[id] = q[0], q[1:]
		stackwalkEnqueued.Add(-int64(len(s.buckets[id])))
	}

	if evt == nil {
		return e
	}

	if evt.IsSurrogateProcess() && s.procs[evt.Params.MustGetPid()] != nil {
		delete(s.procs, evt.Params.MustGetPid())
	}

	callstack := e.Params.MustGetSlice(params.Callstack)
	evt.AppendParam(params.Callstack, params.Slice, callstack)

	// obtain the callstack from the CreateThread event
	// generated by the surrogate/brokered process, such as
	// Secondary Logon.
	// If the remote process id is present in the procs map
	// the stack is attached to the cached event and then
	// pushed to the queue immediately
	if evt.IsCreateRemoteThread() {
		pid := evt.Params.MustGetPid()
		ev, ok := s.procs[pid]
		if ok {
			ev.AppendParam(params.Callstack, params.Slice, callstack)
			_ = s.q.push(ev)
			delete(s.procs, pid)
			// find the most recent CreateProcess event and
			// remove it from buckets as we have the callstack
			qu := s.buckets[ev.StackID()]
			for i := len(qu) - 1; i >= 0; i-- {
				proc := qu[i]
				if !proc.IsCreateProcess() && proc.Params.MustGetPid() != pid {
					continue
				}
				qu = append(qu[:i], qu[i+1:]...)
			}
			s.buckets[ev.StackID()] = qu
		}
	}

	return evt
}

// Stop shutdowns the stack walk decorator flusher.