mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 10:23:54 +00:00
51 lines
1.2 KiB
C++
51 lines
1.2 KiB
C++
/*
|
|
* Copyright (c) 2014-present, Facebook, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* This source code is licensed under the BSD-style license found in the
|
|
* LICENSE file in the root directory of this source tree. An additional grant
|
|
* of patent rights can be found in the PATENTS file in the same directory.
|
|
*
|
|
*/
|
|
|
|
#include <boost/algorithm/string.hpp>
|
|
|
|
#include <osquery/filesystem.h>
|
|
#include <osquery/tables.h>
|
|
|
|
#include "osquery/core/conversions.h"
|
|
|
|
namespace fs = boost::filesystem;
|
|
|
|
namespace osquery {
|
|
namespace tables {
|
|
|
|
const std::string kIOMemLocation = "/proc/iomem";
|
|
|
|
QueryData genMemoryMap(QueryContext& context) {
|
|
QueryData results;
|
|
|
|
std::vector<std::string> regions;
|
|
std::string content;
|
|
readFile(kIOMemLocation, content);
|
|
|
|
regions = osquery::split(content, "\n");
|
|
for (const auto& line : regions) {
|
|
auto b1 = line.find_first_of("-");
|
|
auto b2 = line.find_first_of(" : ");
|
|
if (b1 == std::string::npos || b2 == std::string::npos) {
|
|
continue;
|
|
}
|
|
|
|
Row r;
|
|
r["start"] = "0x" + line.substr(0, b1);
|
|
r["end"] = "0x" + line.substr(b1 + 1, b2 - b1);
|
|
r["name"] = line.substr(b2 + 3);
|
|
results.push_back(r);
|
|
}
|
|
|
|
return results;
|
|
}
|
|
}
|
|
}
|