void OnProcessCreated(ClientProcess process)
{
if (process == null)
{
throw new ArgumentNullException("process");
}
ProcessCreated?.Invoke(this, new ClientProcessEventArgs(process));
}
public virtual int CreateProcess(
ulong ImageFileHandle, ulong Handle, ulong BaseOffset, uint ModuleSize, string ModuleName, string ImageName,
uint CheckSum, uint TimeDateStamp, ulong InitialThreadHandle, ulong ThreadDataOffset, ulong StartOffset)
{
BreakpointHit = true;
StateChanged = true;
ProcessCreated?.Invoke(this, new CreateProcessArgs(ImageFileHandle, Handle, BaseOffset, ModuleSize, ModuleName, ImageName, CheckSum, TimeDateStamp, InitialThreadHandle, ThreadDataOffset, StartOffset));
return((int)DEBUG_STATUS.NO_CHANGE);
}
public virtual void AddProcess(Process process, ProcessManager manager)
{
if (process.SubmissionTime > TimeSpan.Zero)
{
IncomingProcesses++;
manager.RegisterEvent(process.SubmissionTime, (p) =>
{
AddImpl(process);
IncomingProcesses--;
ProcessCreated?.Invoke(process, new(p, process.SubmissionTime, TimeSpan.Zero, GetAllProcesses()));
});
public static void Listen()
{
var session = new TraceEventSession(KernelTraceEventParser.KernelSessionName);
session.StopOnDispose = true;
session.EnableKernelProvider(KernelTraceEventParser.Keywords.ImageLoad | KernelTraceEventParser.Keywords.Process);
session.Source.Kernel.ProcessStart += (ProcessTraceData data) => {
ProcessCreated?.Invoke(data);
};
session.Source.Kernel.ProcessStop += (ProcessTraceData data) => {
ProcessExited?.Invoke(data);
};
new Thread(() => session.Source.Process()).Start();
}
//
public Brain()
{
Guid = Guid.NewGuid();
ProcessCreated = OnProcessCreated;
}
protected virtual void OnProcessCreated(ProcessCreatedArgs e)
{
ProcessCreated?.Invoke(this, e);
}
void OnProcessCreated(TargetProcess process)
{
ProcessCreated?.Invoke(this, new ProcessCreatedEventArgs(process));
}
private void addValidProcess(Process process) => ProcessCreated?.Invoke(process);
private void OnProcessCreated(ProcessCreatedEventArgs e)
{
ProcessCreated?.Invoke(this, e);
}
protected void OnProcessCreate(Process process)
{
ProcessCreated?.Invoke(this, process.ToEventArgs());
}
public void RaiseProcessCreated(string applicationName, string commandLine, int processId, bool isRedirected)
{
ProcessCreated?.Invoke(applicationName, commandLine, processId, isRedirected);
}
