(evt *event.Event)
| 173 | func (s scanner) CanEnqueue() bool { return false } |
| 174 | |
| 175 | func (s *scanner) ProcessEvent(evt *event.Event) (bool, error) { |
| 176 | if evt.IsTerminateProcess() { |
| 177 | // cleanup |
| 178 | pid := evt.Params.MustGetPid() |
| 179 | delete(s.rwxs, pid) |
| 180 | delete(s.mmaps, pid) |
| 181 | } |
| 182 | return s.Scan(evt) |
| 183 | } |
| 184 | |
| 185 | func (s scanner) Scan(e *event.Event) (bool, error) { |
| 186 | var matches yara.MatchRules |
nothing calls this directly
no test coverage detected