Method ProcessEvent

pkg/symbolize/symbolizer.go:197–253

(e *event.Event)

}

func (s *Symbolizer) ProcessEvent(e *event.Event) (bool, error) {
	if e.IsTerminateProcess() {
		// release symbol handler and process handle
		pid := e.Params.MustGetPid()
		s.mu.Lock()
		defer s.mu.Unlock()
		delete(s.mods, pid)
		delete(s.symbols, pid)
		// remove exports for this process
		s.exps.RemoveExports(e.GetParamAsString(params.Exe))
		symCachedSymbols.Add(-int64(len(s.symbols[pid])))
		proc, ok := s.procs[pid]
		if !ok {
			return true, nil
		}
		s.r.Cleanup(proc.handle)
		_ = windows.CloseHandle(proc.handle)
		delete(s.procs, pid)
		return true, nil
	}

	if e.IsLoadModule() || e.IsUnloadModule() {
		filename := e.GetParamAsString(params.ModulePath)
		addr := e.Params.TryGetAddress(params.ModuleBase)
		// if the kernel driver is loaded or unloaded,
		// load/unload symbol handlers respectively
		if (strings.ToLower(filepath.Ext(filename)) == ".sys" ||
			e.Params.TryGetBool(params.FileIsDriver)) && s.config.SymbolizeKernelAddresses {
			if e.IsLoadModule() {
				err := s.r.LoadModule(windows.CurrentProcess(), filename, addr)
				if err != nil {
					log.Errorf("unable to load symbol table for %s module: %v", filename, err)
				}
			} else {
				s.r.UnloadModule(windows.CurrentProcess(), addr)
			}
		}

		// remove module if it has been unmapped from the process VAS
		err := s.syncModules(e)
		if err != nil {
			log.Error(err)
		}
	}

	if !e.Params.Contains(params.Callstack) {
		return true, nil
	}
	defer e.Params.Remove(params.Callstack)

	err := s.processCallstack(e)
	if err != nil {
		callstackProcessErrors.Add(1)
	}

	return true, nil
}