Improve tracing on OSX and Windows
OSX:
- Make the execve more strict to be able to extract more arguments later.
- Fix the initial trace to be less hacky, add strict handling of the initial
process.
Windows:
- Only handle files that were opened by the relevant processes. Keep a
threadid->processid map to be able to figure which process generated the
Create event.
- Only handle files that were actually opened. Detect this implicitly by
looking if the file has a Cleanup event and tracking the kernel file object
instances.
- Add strict handling of the initial process.
- Properly process \\?\ header.
NOTRY=true
R=mad@chromium.org
BUG=98636
TEST=
Review URL: https://chromiumcodereview.appspot.com/10448034
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@139546 0039d316-1c4b-4281-b951-d872f2087c98
1 file changed
