@jellybrick/wql-process-monitor
Version:
Monitor Windows process creation/deletion events via WMI (WQL)
172 lines (171 loc) • 6.27 kB
JavaScript
Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
let node_events = require("node:events");
let node_module = require("node:module");
let node_path = require("node:path");
let node_url = require("node:url");
//#region \0@oxc-project+runtime@0.138.0/helpers/esm/typeof.js
function _typeof(o) {
"@babel/helpers - typeof";
return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o) {
return typeof o;
} : function(o) {
return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
}, _typeof(o);
}
//#endregion
//#region \0@oxc-project+runtime@0.138.0/helpers/esm/toPrimitive.js
function toPrimitive(t, r) {
if ("object" != _typeof(t) || !t) return t;
var e = t[Symbol.toPrimitive];
if (void 0 !== e) {
var i = e.call(t, r || "default");
if ("object" != _typeof(i)) return i;
throw new TypeError("@@toPrimitive must return a primitive value.");
}
return ("string" === r ? String : Number)(t);
}
//#endregion
//#region \0@oxc-project+runtime@0.138.0/helpers/esm/toPropertyKey.js
function toPropertyKey(t) {
var i = toPrimitive(t, "string");
return "symbol" == _typeof(i) ? i : i + "";
}
//#endregion
//#region \0@oxc-project+runtime@0.138.0/helpers/esm/defineProperty.js
function _defineProperty(e, r, t) {
return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
value: t,
enumerable: !0,
configurable: !0,
writable: !0
}) : e[r] = t, e;
}
//#endregion
//#region src/error.ts
var Failure = class extends Error {
constructor(message, code = null) {
super(message);
_defineProperty(this, "code", void 0);
this.code = code;
if (code) this.name = `${this.constructor.name}: ${code}`;
else this.name = this.constructor.name;
if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
}
};
//#endregion
//#region src/index.ts
var _ref, _Symbol$for;
const ARCH = {
x64: "x64",
ia32: "x86",
arm64: "arm64"
};
function load() {
const arch = ARCH[process.arch];
if (!arch) throw new Failure(`Unsupported architecture: ${process.arch}`, "ERR_UNSUPPORTED_ARCH");
const file = (0, node_path.join)((0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href)), "..", "lib", "dist", `processMonitor.${arch}.node`).replace("app.asar", "app.asar.unpacked");
const lib = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href)(file);
const emitter = new node_events.EventEmitter();
lib.setCallback((event, process, pid, filepath) => {
if (event === "creation") emitter.emit("creation", [
process,
pid,
filepath
]);
else if (event === "deletion") emitter.emit("deletion", [process, pid]);
else throw new Failure(`Unknow event "${event}"`, "ERR_UNEXPECTED_EVENT");
});
return {
lib,
emitter
};
}
const { lib, emitter } = (_ref = globalThis)[_Symbol$for = Symbol.for("@jellybrick/wql-process-monitor")] ?? (_ref[_Symbol$for] = load());
function normalize(option = {}) {
return {
filterWindowsNoise: option.filterWindowsNoise || false,
filterUsualProgramLocations: option.filterUsualProgramLocations || false,
creation: option.creation != null ? option.creation : true,
deletion: option.deletion != null ? option.deletion : true,
filter: option.filter && Array.isArray(option.filter) ? option.filter : [],
whitelist: option.whitelist || false
};
}
function assertSubscribable(options) {
if (!options.creation && !options.deletion) throw new Failure("You must subscribe to at least one event", "ERR_INVALID_ARGS");
}
/**
* Promisified version of wql
*/
const promises = {
/**
* @deprecated Since version >= 2.0 this is automatically done for you when you call subscribe(). Method was merely kept for backward compatibility.
*/
createEventSink() {
return lib.createEventSinkAsync().catch((err) => {
throw new Failure(err.message, "ERR_EVENTSINK_INIT_FAIL");
});
},
/**
* Properly close the event sink.
* There is no 'un-subscribe' thing to do prior to closing the sink. Just close it.
* It is recommended to properly close the event sink when you are done if you intend to re-open it later on.
* Most of the time you wouldn't have to bother with this, but it's here in case you need it.
*/
closeEventSink() {
return lib.closeEventSinkAsync();
},
/**
* Subscribe to process creation and deletion events.
*/
async subscribe(option = {}) {
const options = normalize(option);
assertSubscribable(options);
await this.createEventSink();
await lib.getInstanceEventAsync(options.creation, options.deletion, options.filterWindowsNoise, options.filterUsualProgramLocations, options.whitelist, options.filter.toString()).catch((err) => {
throw new Failure(err.message || "Unknown error", "ERR_WQL_QUERY_FAIL");
});
return emitter;
}
};
/**
* @deprecated Since version >= 2.0 this is automatically done for you when you call subscribe(). Method was merely kept for backward compatibility.
*/
function createEventSink() {
try {
lib.createEventSink();
} catch (err) {
throw new Failure(err.message, "ERR_EVENTSINK_INIT_FAIL");
}
}
/**
* Properly close the event sink.
* There is no 'un-subscribe' thing to do prior to closing the sink. Just close it.
* It is recommended to properly close the event sink when you are done if you intend to re-open it later on.
* Most of the time you wouldn't have to bother with this, but it's here in case you need it.
*/
function closeEventSink() {
lib.closeEventSink();
}
/**
* Subscribe to process creation and deletion events.
*
* Usage of promise instead of sync is recommended so that you will not block Node's event loop.
*/
function subscribe(option = {}) {
const options = normalize(option);
assertSubscribable(options);
createEventSink();
try {
lib.getInstanceEvent(options.creation, options.deletion, options.filterWindowsNoise, options.filterUsualProgramLocations, options.whitelist, options.filter.toString());
} catch (err) {
throw new Failure(err.message || "Unknown error", "ERR_WQL_QUERY_FAIL");
}
return emitter;
}
//#endregion
exports.Failure = Failure;
exports.closeEventSink = closeEventSink;
exports.createEventSink = createEventSink;
exports.promises = promises;
exports.subscribe = subscribe;