forked from ycrash/yc-data-script
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathm3_windows.go
92 lines (86 loc) · 1.8 KB
/
m3_windows.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
//go:build windows
// +build windows
package shell
import (
"bufio"
"bytes"
"errors"
"strconv"
"strings"
"shell/config"
)
func GetProcessIds(tokens config.ProcessTokens, excludes config.ProcessTokens) (pids map[int]string, err error) {
arg := "Name != 'WMIC.exe'"
command, err := M3PS.addDynamicArg(arg)
if err != nil {
return
}
output, err := CommandCombinedOutput(command)
if err != nil {
return
}
scanner := bufio.NewScanner(bytes.NewReader(output))
pids = make(map[int]string)
if !scanner.Scan() {
err = errors.New("no line found in the commandline result")
return
}
header := scanner.Text()
header = strings.TrimSpace(header)
indexName := strings.Index(header, "Name")
if indexName < 0 {
err = errors.New("name in the header line")
return
}
Next:
for scanner.Scan() {
line := scanner.Text()
line = strings.TrimSpace(line)
for _, exclude := range excludes {
p := strings.Index(line, string(exclude))
if p >= 0 {
continue Next
}
}
for _, t := range tokens {
token := string(t)
var appName string
index := strings.Index(token, "$")
if index >= 0 {
appName = token[index+1:]
token = token[:index]
}
p := strings.Index(line, token)
if p >= 0 {
line = line[indexName:]
columns := strings.Split(line, " ")
var col []string
for _, column := range columns {
if len(column) <= 0 {
continue
}
col = append(col, column)
if len(col) <= 1 {
continue
}
id := strings.TrimSpace(col[1])
pid, err := strconv.Atoi(id)
if err != nil {
continue Next
}
tokenPid, err := strconv.Atoi(token)
if err == nil {
if tokenPid != pid {
continue Next
}
}
if _, ok := pids[pid]; !ok {
pids[pid] = appName
}
continue Next
}
}
}
}
return
}