Skip to content

Conversation

@rubionic
Copy link

@rubionic rubionic commented Oct 3, 2025

Summary

Changes

macOS Fix

  • File: sigar_darwin.go
  • Updated sysctlbyname() function to use golang.org/x/sys/unix.SysctlUint64() for uint64 values
  • Resolves checkptr failures when running with Go 1.22 and later on Darwin systems

Windows Fix

  • File: sigar_windows.go

    • Implemented ProcArgs.Get() using Win32 API calls instead of returning ErrNotImplemented
    • Uses NtQueryProcessBasicInformation() and ReadProcessMemory() to read process command-line arguments
  • File: sys/windows/syscall_windows.go

    • Added structs: UnicodeString, RtlUserProcessParameters, ProcessBasicInformation
    • Added helper functions:
      • NtQueryProcessBasicInformation() - queries process basic information
      • GetUserProcessParams() - retrieves user process parameters from PEB
      • ReadProcessUnicodeString() - reads Unicode strings from process memory
      • ByteSliceToStringSlice() - converts byte slices to string arrays
      • ReadProcessMemory() - wraps Win32 ReadProcessMemory API
      • GetTickCount64() - wraps Win32 GetTickCount64 API
    • Added syscall declarations for ReadProcessMemory and GetTickCount64
  • File: sys/windows/zsyscall_windows.go

    • Added syscall bindings for ReadProcessMemory and GetTickCount64

Motivation

This PR addresses issue rkoster/rubionic-workspace#38 which requested combining these two important fixes from upstream PRs.

Testing

These changes have been tested in the original upstream PRs:

Fixes rkoster/rubionic-workspace#38

This PR combines two critical fixes:

1. macOS Fix (from cloudfoundry#77):
   - Updates sigar_darwin.go to use unix.SysctlUint64() for reading sysctl values
   - Fixes checkptr violations in Go 1.22+ when accessing uint64 values

2. Windows Fix (from elastic#116):
   - Implements ProcArgs.Get() using Win32 API instead of returning ErrNotImplemented
   - Replaces WMI queries with direct ReadProcessMemory and NtQueryInformationProcess calls
   - Adds helper functions: GetUserProcessParams, ReadProcessUnicodeString, ByteSliceToStringSlice
   - Adds syscall bindings for ReadProcessMemory and GetTickCount64

Fixes rkoster/rubionic-workspace#38
@aramprice
Copy link
Member

@rkoster / @rubionic - looks like some weird merge artifacts resulted in un-compilable code.

The ProcessBasicInformation struct and NtQueryProcessBasicInformation function
were already defined in sys/windows/ntquery.go. Removed duplicate declarations
from sys/windows/syscall_windows.go to fix compilation errors.

Fixes Windows CI build failures in cloudfoundry#78
aramprice added a commit that referenced this pull request Oct 16, 2025
- Fix unchecked error return from syscall.CloseHandle() in sigar_windows.go:193
- Fix goimports formatting issue (trailing whitespace) in sys/windows/syscall_windows.go:380
- Fix goimports formatting issue (extra blank lines) in sys/windows/zsyscall_windows.go:290
@rkoster
Copy link
Contributor

rkoster commented Oct 23, 2025

Thanks, but somebody already took care of this: #79

@rkoster rkoster closed this Oct 23, 2025
aramprice added a commit that referenced this pull request Oct 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

3 participants