https://github.com/kata198/processmappingscanner

Python module for scanning running process mappings (for detecting libraries, executables, etc)
https://github.com/kata198/processmappingscanner

commandline currently find libraries linked mapping process running scanning

Last synced: 6 months ago
JSON representation

Python module for scanning running process mappings (for detecting libraries, executables, etc)

• Host: GitHub
• URL: https://github.com/kata198/processmappingscanner
• Owner: kata198
• License: lgpl-3.0
• Created: 2015-08-30T23:22:32.000Z (over 10 years ago)
• Default Branch: master
• Last Pushed: 2017-06-11T06:02:31.000Z (almost 9 years ago)
• Last Synced: 2025-09-26T09:59:45.656Z (6 months ago)
• Topics: commandline, currently, find, libraries, linked, mapping, process, running, scanning
• Language: Python
• Size: 53.7 KB
• Stars: 2
• Watchers: 3
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • Changelog: ChangeLog
  • License: LICENSE

Awesome Lists containing this project

README

          
# ProcessMappingScanner

Python module for scanning running processes for various pieces of information ( mappings, open files, owner, commandline, etc )

This module works on UNIX-derived systems only (Linux, BSD, cygwin, etc)

What is a mapping?

------------------

A mapping can include the running executable (like python), a shared library (like libc) or something else (like a locale-archive file or other mapping).

You can use this module to, for example, scan for running processes to see what is using libpython2.7, or scan a paticular process for a mapping.

Commandline Tool

----------------

ProcessMappingScanner's functionality is exposed through a commandline tool, [findProcessesUsing](https://github.com/kata198/findProcessesUsing). 

Functions

=========

Mappings

--------

Here are functions to scan running processes for mappings.

The following function, scanProcessForMapping, scans a single process for mappings. Use an empty string for searchPortion to get all mappings.

	def scanProcessForMapping(pid, searchPortion, isExactMatch=False, ignoreCase=False):

		'''

			scanProcessForMapping - Searches a given pid's mappings for a certain pattern.

				@param pid  - A running process ID on this system

				@param searchPortion  - A mapping for which to search, example: libc or python or libz.so.1. Give empty string to return all mappings.

				@param isExactMatch  Default False - If match should be exact, otherwise a partial match is performed.

				@param ignoreCase  Default False - If True, search will be performed case-insensitively

				@return  - If result is found, the following dict is returned. If no match found on the given pid, or pid is not found running, None is returned.

					{

						'searchPortion' : The passed search pattern

						'pid'           : The passed pid (as an integer)

						'owner'         : String of process owner, or uid if no mapping can be found, or "unknown" if neither could be determined.

						'cmdline'       : Commandline string

						'matchedMappings' : All mappings likes that matched the given search pattern

					}

		'''

The following function, scanAllProcessesForMapping, scans all running processes for mappings.

	def scanAllProcessesForMapping(searchPortion, isExactMatch=False, ignoreCase=False):

		'''

			scanAllProcessesForMapping - Scans all processes on the system for a given search pattern.

				@param searchPortion  - A mapping for which to search, example: libc or python or libz.so.1. Give empty string to return all mappings.

				@param isExactMatch  Default False - If match should be exact, otherwise a partial match is performed.

				@param ignoreCase  Default False - If True, search will be performed case-insensitively

			@return -  - A dictionary of pid -> mappingResults for each pid that matched the search pattern. For format of "mappingResults", @see scanProcessForMapping

		'''

Owner

-----

Here are the functions to determine whom is running a process

The following function returns information on the owner of a given process (uid, username):

	def getProcessOwner(pid):

		'''

			getProcessOwner - Get the process owner of a pid

			@param pid  - process id

			@return - None if process not found or can't be determined. Otherwise, a dict: 

				{

					uid  - Owner UID

					name - Owner name, or None if one cannot be determined

				}

		'''

The following functions returns a string of the owner of a given process:

	def getProcessOwnerStr(pid):

		'''

			getProcessOwner - Get Process owner of a pid as a string instead of components (#getProcessOwner)

			@return - Returns username if it can be determined, otherwise uid, otherwise "unknown"

		'''

Commandline

-----------

The following functions get the commandline (executable and arguments) for a running process.

The following function returns a string of the commandline of a running process:

	def getProcessCommandLineStr(pid):

		'''

			getProcessCommandLineStr - Gets a the commandline (program + arguments) of a given pid

			@param pid  - Process ID

			@return - None if process not found or can't be determined. Otherwise a string of commandline.

			@note Caution, args may have spaces in them, and you cannot surmise from this method. If you care (like trying to replay a command), use getProcessCommandLineList instead

		'''

The following function returns a list representing the "argv" of a process.

	def getProcessCommandLineList(pid):

		'''

			getProcessCommandLineList - Gets the commandline (program + argumentS) of a given pid as a list.

			@param pid  - Process ID

			@return - None if process not found or can't be determined. Otherwise a list representing argv. First argument is process name, remainder are arguments.

			@note - Use this if you care about whether a process had a space in the commands

		'''

Files

-----

The following functions deal with open file descriptors (fds) of running processes.

The following function returns information on a process 

	def scanProcessForOpenFile(pid, searchPortion, isExactMatch=True, ignoreCase=False):

		'''

			scanProcessForOpenFile - Scans open FDs for a given pid to see if any are the provided searchPortion

				@param searchPortion  - Filename to check

				@param isExactMatch  Default True - If match should be exact, otherwise a partial match is performed.

				@param ignoreCase  Default False - If True, search will be performed case-insensitively

			@return -  If result is found, the following dict is returned. If no match found on the given pid, or the pid is not found running, None is returned.

					{

						'searchPortion' : The search portion provided

						'pid'           : The passed pid (as an integer)

						'owner'         : String of process owner, or "unknown" if one could not be determined

						'cmdline'       : Commandline string

						'fds'           : List of file descriptors assigned to this file (could be mapped several times)

						'filenames'     : List of the filenames matched

					}

		'''

The following function scans all processes on a system for an open file:

	def scanAllProcessesForOpenFile(searchPortion, isExactMatch=True, ignoreCase=False):

		'''

			scanAllProcessessForOpenFile - Scans all processes on the system for a given filename

				@param searchPortion  - Filename to check

				@param isExactMatch  Default True - If match should be exact, otherwise a partial match is performed.

				@param ignoreCase  Default False - If True, search will be performed case-insensitively

			@return -  - A dictionary of pid -> mappingResults for each pid that matched the search pattern. For format of "mappingResults", @see scanProcessForOpenFile

		'''

Current Working Directory

-------------------------

The current working directory (CWD) of a process can be found via:

	def getProcessCwd(pid)

	'''

		getProcessCwd - Gets the cwd (current working directory) of a given pid

		@param pid  - Process ID

		@return  - None if process not found or can't be determined. Otherwise, a string of the CWD

	'''

Also contains scan functions, like those described above, *scanProcessForCwd* and *scanAllProcessessForCwd*.

General

-------

The following are general functions

The following function returns a list of all pids running on a system

	def getAllRunningPids():

Design

------

All of the "scan" series of functions return some extra information about the process (owner/cmdline). This is because processes can begin and end quickly, so it's better to get a complete snapshot than to not be able to obtain one later.

Pydoc

=====

Pydoc can be found at: http://pythonhosted.org/ProcessMappingScanner/