def memory(event):
"""
Thread to monitor program memory allocations
"""
while not Thread.get_interrupt():
current, peak = tracemalloc.get_traced_memory()
logger.info(f"Current: {current / 10**6}MB | " +
f"Peak: {peak / 10**6}MB [{Thread.name()}]")
event.wait(timeout=MEMORY_WATCHDOG_INTERVAL)
logger.info(f"Terminated [{Thread.name()}]")
def bulk_manager(event):
"""
Manages session_yara() and threat()
"""
while not Thread.get_interrupt():
temp_plist = Vault.get_threading_plist()
logger.info(f"{len(temp_plist)} packets processed [{Thread.name()}]")
stream_dict = find_streams(temp_plist)
Vault.add_session(stream_dict)
session_yara(stream_dict)
threat(temp_plist)
all_sessions = Vault.get_session_headers()
logger.info(f"{len(all_sessions)} total sessions [{Thread.name()}]")
event.wait(timeout=BULK_MANAGER_INTERVAL)
logger.info(f"Terminated [{Thread.name()}]")
def session_caching_mp(event):
"""
DEPRECIATED!
Process to periodically cache session payload into .cache.\n
Process creation is expensive and shared memory in python is out of my pay grade,
hence the usage of threads instead
"""
while not Thread.get_interrupt():
sessions = Vault.get_sessions(reset=True)
pool = Pool()
pool.map(session_worker, sessions.items())
pool.close()
pool.join()
logger.info(f"cached to local file [{Thread.name()}]")
event.wait(timeout=SESSION_CACHING_INTERVAL)
logger.info(f"Terminated [{Thread.name()}]")
def session_caching(event):
"""
Thread to periodically cache session payload into .cache
"""
while not Thread.get_interrupt():
runtime_path = f"{SESSION_CACHE_PATH}/{Vault.get_runtime_name()}"
cache_files = [f for f in listdir(runtime_path) if isfile(join(runtime_path, f))]
sessions = Vault.get_sessions(reset=True)
for header, plist in sessions.items():
if (payload := extract_payload(plist, pure=True)) is None:
continue
header = header.replace(" ", "_").replace(":", "-")
if header in cache_files:
with open(f"{runtime_path}/{header}", "ab+") as file:
# f.seek(0, 2)
file.write(payload)
else:
with open(f"{runtime_path}/{header}", "wb+") as file:
file.write(payload)
logger.info(f"Cached to .cache [{Thread.name()}]")
event.wait(timeout=SESSION_CACHING_INTERVAL)
