feat: process sections

Author: secDre4mer

thorlog/v3/process.go

@@ -46,7 +46,29 @@ type ProcessInfo struct {
 
 	ProcessConnections `textlog:",expand"`
 
-	Memory *SparseData `json:"memory,omitempty" textlog:"memory,expand,omitempty"`
+	Sections []Section `json:"sections,omitempty" textlog:"-"`
+}
+
+// Section describes a memory range in a process's virtual memory.
+// This typically corresponds to a section in an executable file or library, such as .text, .data, etc.,
+// or a stack, heap, or similar.
+// In linux terms: it corresponds to a line in /proc/<pid>/maps.
+type Section struct {
+	// Name of the section. For sections from loaded libraries, this is the library's file path.
+	// For other memory ranges, this is OS specific and may be empty.
+	Name string `json:"name"`
+	// Address is the start address of the section in the process's virtual memory.
+	// The end address of the section can be calculated as Address + SparseData.Length.
+	Address uint64 `json:"address"`
+	// Offset is the offset within the mapped file or library, if this section
+	// corresponds to a file section. If this section does not correspond to a file,
+	// this is empty.
+	Offset uint64 `json:"offset,omitempty"`
+	// SparseData contains a sparse representation of the section's data.
+	// Only the interesting parts of the section are included, typically those that have been matched.
+	SparseData SparseData `json:"sparse_data"`
+	// Permissions of the section.
+	Permissions RwxPermissions `json:"permissions"`
 }
 
 type ProcessConnections struct {

thorlog/v3/sparsedata.go

@@ -12,7 +12,9 @@ import (
 type SparseData struct {
 	jsonlog.ObjectHeader
 	Elements []SparseDataElement `json:"elements" jsonschema:"nullable"`
-	Length   int64               `json:"length"`
+	// Length is the total length of the data that this sparse data object describes.
+	// In other words, all Elements are within an address range of [0, Length).
+	Length int64 `json:"length"`
 }
 
 const truncateSequence = "[...]"