RBOOL
rpal_blob_insert
(
rBlob blob,
RPVOID pData,
RU32 size,
RU32 offset
)
{
RBOOL isAdded = FALSE;
_prBlob pBlob = (_prBlob)blob;
if( rpal_memory_isValid( blob ) &&
NULL != pData &&
0 != size )
{
if( pBlob->currentSize - pBlob->sizeUsed < size )
{
pBlob->currentSize += ( 0 != pBlob->growBy ? pBlob->growBy : size );
pBlob->pData = rpal_memory_realloc_from( pBlob->pData,
pBlob->currentSize + sizeof( RWCHAR ),
pBlob->from );
}
if( rpal_memory_isValid( pBlob->pData ) )
{
// Relocate existing data
rpal_memory_memmove( pBlob->pData + offset + size,
pBlob->pData + offset,
pBlob->sizeUsed - offset );
rpal_memory_memcpy( pBlob->pData + offset, pData, size );
pBlob->sizeUsed += size;
// We allocate WCHAR more than we need always to ensure that if the buffer contains a wide string it will be terminated
rpal_memory_zero( pBlob->pData + pBlob->sizeUsed, sizeof( RWCHAR ) );
isAdded = TRUE;
}
}
else if( NULL == pData ||
0 == size )
{
isAdded = TRUE;
}
if( isAdded )
{
if( !rpal_memory_isValid( pBlob->pData ) )
{
isAdded = FALSE;
rpal_debug_break();
}
}
return isAdded;
}
static RVOID
kernelModeDiff
(
rEvent isTimeToStop
)
{
RU32 i = 0;
RU32 nScratch = 0;
RU32 nProcessEntries = 0;
KernelAcqProcess new_from_kernel[ 200 ] = { 0 };
processEntry tracking_user[ MAX_SNAPSHOT_SIZE ] = { 0 };
while( !rEvent_wait( isTimeToStop, 1000 ) )
{
nScratch = ARRAY_N_ELEM( new_from_kernel );
rpal_memory_zero( new_from_kernel, sizeof( new_from_kernel ) );
if( !kAcq_getNewProcesses( new_from_kernel, &nScratch ) )
{
rpal_debug_warning( "kernel acquisition for new processes failed" );
g_is_kernel_failure = TRUE;
break;
}
for( i = 0; i < nScratch; i++ )
{
notifyOfProcess( new_from_kernel[ i ].pid,
new_from_kernel[ i ].ppid,
TRUE,
new_from_kernel[ i ].path,
new_from_kernel[ i ].cmdline,
new_from_kernel[ i ].uid,
new_from_kernel[ i ].ts );
if( nProcessEntries >= ARRAY_N_ELEM( tracking_user ) - 1 )
{
continue;
}
tracking_user[ nProcessEntries ].pid = new_from_kernel[ i ].pid;
tracking_user[ nProcessEntries ].ppid = new_from_kernel[ i ].ppid;
nProcessEntries++;
}
for( i = 0; i < nProcessEntries; i++ )
{
if( !processLib_isPidInUse( tracking_user[ i ].pid ) )
{
notifyOfProcess( tracking_user[ i ].pid,
tracking_user[ i ].ppid,
FALSE,
NULL,
NULL,
KERNEL_ACQ_NO_USER_ID,
0 );
if( nProcessEntries != i + 1 )
{
rpal_memory_memmove( &(tracking_user[ i ]), &(tracking_user[ i + 1 ]), nProcessEntries - i + 1 );
}
nProcessEntries--;
}
}
}
}
PObsNode
addTransition
(
PObsNode parent,
PObsNode node,
PObsNode to,
RU8 onValue
)
{
PObsNode retNode = NULL;
RU32 currentNodeSize = 0;
RU8 numElemToAdd = 0;
RU8 indexToInsert = 0;
PObsNode originalNode = node;
RU32 i = 0;
if( rpal_memory_isValid( node ) )
{
currentNodeSize = sizeof( ObsNode ) + ( node->nElements * sizeof( RPVOID ) );
if( !IS_IN_RANGE( node, onValue ) )
{
if( onValue >= node->startOffset + node->nElements )
{
numElemToAdd = onValue - ( node->startOffset + node->nElements ) + 1;
}
else
{
numElemToAdd = node->startOffset - onValue;
}
if( node->nAllocated < node->nElements + numElemToAdd )
{
node = rpal_memory_realloc( node, currentNodeSize + ( numElemToAdd * sizeof( RPVOID ) ) );
rpal_memory_zero( node->elements + node->nElements, numElemToAdd * sizeof( RPVOID ) );
node->nAllocated = node->nElements + numElemToAdd;
}
if( onValue < node->startOffset &&
0 < node->nElements )
{
rpal_memory_memmove( node->elements + numElemToAdd, node->elements, node->nElements * sizeof( RPVOID ) );
node->startOffset = node->startOffset - (RU8)numElemToAdd;
}
node->nElements += numElemToAdd;
// The above realloc may have changed the pointer so we need
// to update it in the parent, if it exists...
if( NULL != parent &&
originalNode != node )
{
for( i = 0; i < parent->nElements; i++ )
{
if( originalNode == parent->elements[ i ] )
{
parent->elements[ i ] = node;
}
}
}
}
indexToInsert = EFFECTIVE_INDEX( node, onValue );
if( NULL == node->elements[ indexToInsert ] )
{
node->elements[ indexToInsert ] = to;
retNode = node;
}
}
return retNode;
}
