From b0ba084b5ef80c7ca87f6a60185295caec2d7514 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Mon, 31 Aug 2026 21:53:32 +0800 Subject: [PATCH] Global: address review comments v2 --- src/detection/processes/processes_obsd.c | 3 ++- src/detection/processes/processes_windows.c | 7 +++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/detection/processes/processes_obsd.c b/src/detection/processes/processes_obsd.c index d0de8170d..8c50065a0 100644 --- a/src/detection/processes/processes_obsd.c +++ b/src/detection/processes/processes_obsd.c @@ -13,7 +13,8 @@ const char* ffDetectProcesses(const FFProcessesOptions* options, FFProcessesResu } int count = 0; - // KERN_PROC_ALL returns all user-level processes, excluding kernel processes and threads + // KERN_PROC_ALL returns all user-level processes + // KERN_PROC_KTHREAD returns all processes, including user-level processes (despite the name) const struct kinfo_proc* procs = kvm_getprocs(kd, (options->countKprocs ? KERN_PROC_KTHREAD : KERN_PROC_ALL) | KERN_PROC_SHOW_THREADS, 0, sizeof(struct kinfo_proc), &count); diff --git a/src/detection/processes/processes_windows.c b/src/detection/processes/processes_windows.c index af09f6a91..0a2ba2f41 100644 --- a/src/detection/processes/processes_windows.c +++ b/src/detection/processes/processes_windows.c @@ -26,11 +26,10 @@ const char* ffDetectProcesses(const FFProcessesOptions* options, FFProcessesResu } for (SYSTEM_PROCESS_INFORMATION* ptr = pstart; ; ptr = (SYSTEM_PROCESS_INFORMATION*) ((uint8_t*) ptr + ptr->NextEntryOffset)) { - if (!options->countKprocs && (uintptr_t) ptr->InheritedFromUniqueProcessId > 0) { - continue; + if (options->countKprocs || (uintptr_t) ptr->InheritedFromUniqueProcessId > 0) { + ++result->processes; + result->threads += ptr->NumberOfThreads; } - ++result->processes; - result->threads += ptr->NumberOfThreads; if (ptr->NextEntryOffset == 0) { break; }