perf(rule_engine): Read file data via overlapped I/O

internal/etw/processors/chain_windows.go

@@ -57,7 +57,7 @@ func NewChain(
 		chain.addProcessor(newRegistryProcessor(hsnap))
 	}
 	if config.EventSource.EnableImageEvents {
-		chain.addProcessor(newImageProcessor(psnap))
+		chain.addProcessor(newModuleProcessor(psnap))
 	}
 	if config.EventSource.EnableNetEvents {
 		chain.addProcessor(newNetProcessor())

internal/etw/processors/fs_windows.go

@@ -44,8 +44,6 @@ var (
 	fileObjectMisses     = expvar.NewInt("fs.file.objects.misses")
 	fileObjectHandleHits = expvar.NewInt("fs.file.object.handle.hits")
 	fileReleaseCount     = expvar.NewInt("fs.file.releases")
-
-	fsFileCharacteristicsRateLimits = expvar.NewInt("fs.file.characteristics.rate.limits")
 )
 
 type fsProcessor struct {
@@ -243,23 +241,6 @@ func (f *fsProcessor) processEvent(e *event.Event) (*event.Event, error) {
 			}
 		}
 
-		// parse PE data for created files and append parameters
-		if ev.IsCreateDisposition() && ev.IsSuccess() {
-			if !f.lim.Allow() {
-				fsFileCharacteristicsRateLimits.Add(1)
-				return ev, nil
-			}
-			path := ev.GetParamAsString(params.FilePath)
-			c, err := parseImageFileCharacteristics(path)
-			if err != nil {
-				return ev, nil
-			}
-			ev.AppendParam(params.FileIsDLL, params.Bool, c.isDLL)
-			ev.AppendParam(params.FileIsDriver, params.Bool, c.isDriver)
-			ev.AppendParam(params.FileIsExecutable, params.Bool, c.isExe)
-			ev.AppendParam(params.FileIsDotnet, params.Bool, c.isDotnet)
-		}
-
 		return ev, nil
 	case event.ReleaseFile:
 		fileReleaseCount.Add(1)

internal/etw/processors/fs_windows_test.go

@@ -19,6 +19,10 @@
 package processors
 
 import (
+	"os"
+	"reflect"
+	"testing"
+
 	"github.com/rabbitstack/fibratus/pkg/config"
 	"github.com/rabbitstack/fibratus/pkg/event"
 	"github.com/rabbitstack/fibratus/pkg/event/params"
@@ -31,9 +35,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	"os"
-	"reflect"
-	"testing"
 )
 
 func TestFsProcessor(t *testing.T) {
@@ -166,10 +167,6 @@ func TestFsProcessor(t *testing.T) {
 				assert.Equal(t, "Success", e.GetParamAsString(params.NTStatus))
 				assert.Equal(t, "File", e.GetParamAsString(params.FileType))
 				assert.Equal(t, "CREATE", e.GetParamAsString(params.FileOperation))
-				assert.True(t, e.Params.MustGetBool(params.FileIsExecutable))
-				assert.False(t, e.Params.MustGetBool(params.FileIsDotnet))
-				assert.False(t, e.Params.MustGetBool(params.FileIsDLL))
-				assert.False(t, e.Params.MustGetBool(params.FileIsDriver))
 			},
 		},
 		{
@@ -195,33 +192,6 @@ func TestFsProcessor(t *testing.T) {
 				assert.Empty(t, fsProcessor.files)
 			},
 		},
-		{
-			"parse created file characteristics",
-			&event.Event{
-				Type:     event.CreateFile,
-				Category: event.File,
-				Params: event.Params{
-					params.FileObject:        {Name: params.FileObject, Type: params.Uint64, Value: uint64(18446738026482168384)},
-					params.ThreadID:          {Name: params.ThreadID, Type: params.Uint32, Value: uint32(1484)},
-					params.FileCreateOptions: {Name: params.FileCreateOptions, Type: params.Uint32, Value: uint32(1223456)},
-					params.FilePath:          {Name: params.FilePath, Type: params.UnicodeString, Value: exe},
-					params.FileShareMask:     {Name: params.FileShareMask, Type: params.Uint32, Value: uint32(5)},
-					params.FileIrpPtr:        {Name: params.FileIrpPtr, Type: params.Uint64, Value: uint64(1234543123112321)},
-					params.FileOperation:     {Name: params.FileOperation, Type: params.Uint64, Value: uint64(2)},
-				},
-			},
-			nil,
-			func() *handle.SnapshotterMock {
-				hsnap := new(handle.SnapshotterMock)
-				return hsnap
-			},
-			func(e *event.Event, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
-				fsProcessor := p.(*fsProcessor)
-				assert.True(t, e.WaitEnqueue)
-				assert.Contains(t, fsProcessor.irps, uint64(1234543123112321))
-				assert.True(t, reflect.DeepEqual(e, fsProcessor.irps[1234543123112321]))
-			},
-		},
 		{
 			"unmap view file",
 			&event.Event{

internal/etw/processors/module_windows.go

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package processors
+
+import (
+	"github.com/rabbitstack/fibratus/pkg/event"
+	"github.com/rabbitstack/fibratus/pkg/event/params"
+	"github.com/rabbitstack/fibratus/pkg/ps"
+)
+
+type moduleProcessor struct {
+	psnap ps.Snapshotter
+}
+
+func newModuleProcessor(psnap ps.Snapshotter) Processor {
+	m := &moduleProcessor{psnap: psnap}
+
+	return m
+}
+
+func (*moduleProcessor) Name() ProcessorType { return Image }
+
+func (m *moduleProcessor) ProcessEvent(e *event.Event) (*event.Event, bool, error) {
+	if e.IsLoadImageInternal() {
+		// state management
+		return e, false, m.psnap.AddModule(e)
+	}
+
+	if e.IsUnloadImage() {
+		pid := e.Params.MustGetPid()
+		addr := e.Params.TryGetAddress(params.ImageBase)
+		if pid == 0 {
+			pid = e.PID
+		}
+		return e, false, m.psnap.RemoveModule(pid, addr)
+	}
+
+	if e.IsLoadImage() || e.IsImageRundown() {
+		return e, false, m.psnap.AddModule(e)
+	}
+
+	return e, true, nil
+}
+
+func (m *moduleProcessor) Close() {}

internal/etw/processors/image_windows_test.go → internal/etw/processors/module_windows_test.go

@@ -19,6 +19,10 @@
 package processors
 
 import (
+	"os"
+	"path/filepath"
+	"testing"
+
 	"github.com/rabbitstack/fibratus/pkg/event"
 	"github.com/rabbitstack/fibratus/pkg/event/params"
 	"github.com/rabbitstack/fibratus/pkg/ps"
@@ -27,12 +31,9 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	"os"
-	"path/filepath"
-	"testing"
 )
 
-func TestImageProcessor(t *testing.T) {
+func TestModuleProcessor(t *testing.T) {
 	var tests = []struct {
 		name       string
 		e          *event.Event
@@ -84,11 +85,6 @@ func TestImageProcessor(t *testing.T) {
 			},
 			func(e *event.Event, t *testing.T, psnap *ps.SnapshotterMock) {
 				psnap.AssertNumberOfCalls(t, "AddModule", 1)
-				// should be enriched with image characteristics params
-				assert.True(t, e.Params.MustGetBool(params.FileIsDLL))
-				assert.True(t, e.Params.MustGetBool(params.FileIsDotnet))
-				assert.False(t, e.Params.MustGetBool(params.FileIsExecutable))
-				assert.False(t, e.Params.MustGetBool(params.FileIsDriver))
 			},
 		},
 		{
@@ -119,7 +115,7 @@ func TestImageProcessor(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			psnap := tt.psnap()
-			p := newImageProcessor(psnap)
+			p := newModuleProcessor(psnap)
 			var err error
 			tt.e, _, err = p.ProcessEvent(tt.e)
 			require.NoError(t, err)