fix(event): Invalid thread id for Map/Unmap view file events

rabbitstack · rabbitstack · commit 4c55e1ea578e · 2024-12-16T19:41:04.000+01:00
These events don't contain the thread id parameter,
so trying to adjust the tid will always yield to an
invalid value.
diff --git a/pkg/kevent/kevent_windows.go b/pkg/kevent/kevent_windows.go
@@ -84,7 +84,7 @@ func (e *Kevent) adjustPID() {
 		}
 	case ktypes.File:
 		if !e.IsMapViewFile() && !e.IsUnmapViewFile() {
-			// take thread if from the event parameters
+			// take thread id from the event parameters
 			e.Tid, _ = e.Kparams.GetTid()
 		}
 		switch {

Original file line number	Diff line number	Diff line change
`@@ -84,7 +84,7 @@ func (e *Kevent) adjustPID() {`
`84`	`84`	`}`
`85`	`85`	`case ktypes.File:`
`86`	`86`	`if !e.IsMapViewFile() && !e.IsUnmapViewFile() {`
`87`		`- // take thread if from the event parameters`
	`87`	`+ // take thread id from the event parameters`
`88`	`88`	`e.Tid, _ = e.Kparams.GetTid()`
`89`	`89`	`}`
`90`	`90`	`switch {`