procmon.h

Go to the documentation of this file.

 
#ifndef __PROCMON_H__
#define __PROCMON_H__
 
#include "wtap.h"
 
typedef struct procmon_module_t {
    nstime_t timestamp;
    uint64_t base_address;
    uint32_t size;
    const char *image_path;
    const char *version;
    const char *company;
    const char *description;
} procmon_module_t;
 
typedef struct procmon_process_t {
    nstime_t start_time;
    nstime_t end_time;
    uint64_t authentication_id;
    uint32_t process_id;
    uint32_t parent_process_id;
    uint32_t parent_process_index;
    uint32_t session_number;
    const char *integrity;
    const char *user_name;
    const char *process_name;
    const char *image_path;
    const char *command_line;
    const char *company;
    const char *version;
    const char *description;
    procmon_module_t *modules;
    uint32_t num_modules;
    bool is_virtualized : 1;
    bool is_64_bit      : 1;
} procmon_process_t;
 
wtap_open_return_val procmon_open(wtap *wth, int *err, char **err_info);
 
#endif