feat: better labeling for matches on sections

Author: secDre4mer

thorlog/v3/process.go

@@ -46,9 +46,11 @@ type ProcessInfo struct {
 
 	ProcessConnections `textlog:",expand"`
 
-	Sections []Section `json:"sections,omitempty" textlog:"-"`
+	Sections Sections `json:"sections,omitempty" textlog:"-"`
 }
 
+type Sections []Section
+
 // Section describes a memory range in a process's virtual memory.
 // This typically corresponds to a section in an executable file or library, such as .text, .data, etc.,
 // or a stack, heap, or similar.
@@ -72,6 +74,22 @@ type Section struct {
 	Permissions RwxPermissions `json:"permissions"`
 }
 
+// RelativeTextPointer implements the jsonlog.TextReferenceResolver interface for Sections.
+// It resolves a reference to a Section's SparseData field to a human-readable string.
+func (s *Sections) RelativeTextPointer(pointee any) (string, bool) {
+	for i := range *s {
+		section := &(*s)[i]
+		if pointee == &section.SparseData {
+			if section.Name != "" {
+				return section.Name, true
+			} else {
+				return fmt.Sprintf("0x%x", section.Address), true
+			}
+		}
+	}
+	return "", false
+}
+
 type ProcessConnections struct {
 	ListenPorts     ProcessListenPorts  `json:"listen_ports" textlog:"listen_ports,omitempty" jsonschema:"nullable"`
 	Connections     []ProcessConnection `json:"connections" textlog:"-" jsonschema:"nullable"`