UUID is meant to offer a more robust version of process ID that is resistant to being repeated. Process start key was introduced in Windows 10 1507 and is derived from _KUSER_SHARED_DATA.BootId and EPROCESS.SequenceNumber both of which increment and are unlikely to overflow. This method uses a combi
()
| 118 | // to fabric a unique process identifier. If this is not possible, the uuid |
| 119 | // is computed by using the process start time. |
| 120 | func (ps *PS) UUID() uint64 { |
| 121 | if ps.uuid != 0 { |
| 122 | return ps.uuid |
| 123 | } |
| 124 | // assume the uuid is derived from boot ID and process start time |
| 125 | ps.uuid = (bootid.Read() << 30) + uint64(ps.PID) | uint64(ps.StartTime.UnixNano()) |
| 126 | maj, _, patch := windows.RtlGetNtVersionNumbers() |
| 127 | if maj >= 10 && patch >= 1507 { |
| 128 | seqNum := querySequenceNumber(ps.PID) |
| 129 | // prefer the most robust variant of the uuid which uses the |
| 130 | // process sequence number obtained from the process object |
| 131 | if seqNum != 0 { |
| 132 | ps.uuid = (bootid.Read() << 30) | seqNum |
| 133 | } |
| 134 | } |
| 135 | return ps.uuid |
| 136 | } |
| 137 | |
| 138 | // AssignUUID assigns the UUID from the given |
| 139 | // process if the UUID has been initialized. |