From 7ec0c664c541063dade5280c9e0efdde5ed6bdcf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Wed, 4 Jun 2025 14:24:12 +0800 Subject: [PATCH] Swap (Windows): detect detailed info --- src/detection/swap/swap.h | 3 ++- src/detection/swap/swap_windows.c | 15 +++++++++------ 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/src/detection/swap/swap.h b/src/detection/swap/swap.h index 1bbcf1766..227b4968e 100644 --- a/src/detection/swap/swap.h +++ b/src/detection/swap/swap.h @@ -4,8 +4,9 @@ typedef struct FFSwapResult { + FFstrbuf name; uint64_t bytesUsed; uint64_t bytesTotal; } FFSwapResult; -const char* ffDetectSwap(FFSwapResult* swap); +const char* ffDetectSwap(FFlist* result /* List of FFSwapResult */); diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c index cd6e0d88e..26be6d204 100644 --- a/src/detection/swap/swap_windows.c +++ b/src/detection/swap/swap_windows.c @@ -1,11 +1,12 @@ #include "swap.h" #include "util/mallocHelper.h" +#include "util/windows/unicode.h" #include #include #include -const char* ffDetectSwap(FFSwapResult* swap) +const char* ffDetectSwap(FFlist* result) { uint8_t buffer[4096]; ULONG size = sizeof(buffer); @@ -13,16 +14,18 @@ const char* ffDetectSwap(FFSwapResult* swap) if(!NT_SUCCESS(NtQuerySystemInformation(SystemPagefileInformation, pstart, size, &size))) return "NtQuerySystemInformation(SystemPagefileInformation, size) failed"; + uint32_t pageSize = instance.state.platform.sysinfo.pageSize; for (SYSTEM_PAGEFILE_INFORMATION* current = pstart; ; current = (SYSTEM_PAGEFILE_INFORMATION*)((uint8_t*) current + current->NextEntryOffset)) { - swap->bytesUsed += current->TotalUsed; - swap->bytesTotal += current->CurrentSize; + FFSwapResult* swap = ffListAdd(result); + ffStrbufInitNWS(&swap->name, current->FileName.Length / sizeof(wchar_t), current->FileName.Buffer); + if (ffStrbufStartsWithS(&swap->name, "\\??\\")) + ffStrbufSubstrAfter(&swap->name, strlen("\\??\\") - 1); + swap->bytesUsed = current->TotalUsed * pageSize; + swap->bytesTotal = current->CurrentSize * pageSize; if (current->NextEntryOffset == 0) break; } - uint32_t pageSize = instance.state.platform.sysinfo.pageSize; - swap->bytesUsed *= pageSize; - swap->bytesTotal *= pageSize; return NULL; }