fix: track Windows local process trees safely
This commit is contained in:
@@ -90,11 +90,27 @@ function Get-RecordedProcesses {
|
||||
|
||||
function Test-RecordedProcess {
|
||||
param($Record)
|
||||
$process = Get-Process -Id $Record.Pid -ErrorAction SilentlyContinue
|
||||
|
||||
try {
|
||||
$recordedProcessId = [int]$Record.Pid
|
||||
if ($recordedProcessId -le 0) { return $false }
|
||||
$recordedStartTime = if ($Record.StartTimeUtc -is [datetime]) {
|
||||
$Record.StartTimeUtc.ToUniversalTime()
|
||||
}
|
||||
else {
|
||||
[datetime]::Parse(
|
||||
[string]$Record.StartTimeUtc,
|
||||
[System.Globalization.CultureInfo]::InvariantCulture,
|
||||
[System.Globalization.DateTimeStyles]::RoundtripKind
|
||||
).ToUniversalTime()
|
||||
}
|
||||
}
|
||||
catch { return $false }
|
||||
|
||||
$process = Get-Process -Id $recordedProcessId -ErrorAction SilentlyContinue
|
||||
if (-not $process) { return $false }
|
||||
try {
|
||||
$actual = $process.StartTime.ToUniversalTime().ToString('o')
|
||||
return $actual -eq $Record.StartTimeUtc
|
||||
return $process.StartTime.ToUniversalTime().Ticks -eq $recordedStartTime.Ticks
|
||||
}
|
||||
catch { return $false }
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user