Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix MultipleProcessesReturned caused by parent PID reuse #939

Merged
merged 3 commits into from
Jul 26, 2024

Conversation

psrok1
Copy link
Member

@psrok1 psrok1 commented Jul 25, 2024

As said in #679 and #938 - PPIDs are not guaranteed to be real and can be reused. On the other hand, initial enumeration of processes is done in order of EPROCESS linked list, so new processes should be further in list than older ones.

It means that if we have situation like:

{"PID": 348, "PPID": 336, "name": "csrss.exe"}
...
{"PID": 336, "PPID": 1984, "name": "taskhost.exe"}
{"PID": 2044, "PPID": 336, "name": "some_child_of_taskhost.exe"}

taskhost is further on list, so PPID of csrss.exe is phantom (and should be treated as process without parent) and the real children of PPID 336 are placed further in list.

In this PR:

  • I removed creation of Mocked processes as creating a mock reserves a PID that shouldn't be reserved at that single moment.
  • I removed MissingParentProcessError because we shouldn't throw an exception in that case: even if something weird happened with parent, we still have valuable information for newly created process that can be tracked - there is no point to throw whole entry because of that.

closes #679, closes #938

@psrok1
Copy link
Member Author

psrok1 commented Jul 26, 2024

Yup, works much better
image

@psrok1 psrok1 merged commit 15e7921 into master Jul 26, 2024
6 checks passed
@psrok1 psrok1 deleted the fix/pstree-parent-reuse branch July 26, 2024 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant