Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gitPidStatus on Windows doesn't correctly identify suspended processes #66

Open
leehinman opened this issue Dec 15, 2022 · 0 comments
Open
Labels
bug Something isn't working Team:Elastic-Agent Label for the Agent team

Comments

@leehinman
Copy link
Contributor

func getPidStatus(pid int) (PidState, error) {
handle, err := syscall.OpenProcess(processQueryLimitedInfoAccess, false, uint32(pid))
if err != nil {
return Unknown, fmt.Errorf("OpenProcess failed for pid=%v: %w", pid, err)
}
defer func() {
_ = syscall.CloseHandle(handle)
}()
var exitCode uint32
err = syscall.GetExitCodeProcess(handle, &exitCode)
if err != nil {
return Unknown, fmt.Errorf("GetExitCodeProcess failed for pid=%v: %w", pid, err)
}
if exitCode == 259 { //still active
return Running, nil
}
return Sleeping, nil
}

The Win32 GetExitCodeProcess Function doesn't directly return if a process is suspended. For Windows, to see if a process is suspended we would have to check all of the process threads and make sure those are suspended. This may require using the non-stable wininternal api.

@leehinman leehinman added the bug Something isn't working label Dec 15, 2022
@cmacknz cmacknz added the Team:Elastic-Agent Label for the Agent team label Dec 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Team:Elastic-Agent Label for the Agent team
Projects
None yet
Development

No branches or pull requests

2 participants