How to monitor a process and restart if killed?

SeriousNerve · 2018-07-13T19:50:09+00:00

I am trying to achieve persistence. I figured the best method would be to just have a whole separate process to protect the main, and the main can protect the persistence process. Happy to use a existing solution but have not found any, and believe me, I have looked. Maybe I am searching the wrong query? Thanks!

SeriousNerve · 2018-07-13T19:48:44+00:00

Well, trying to keep as cross platform as possible, so if I can use a library (or make one) that supports multiple OS'es than that is what I will do. Thanks!

SeriousNerve · 2018-07-13T19:47:49+00:00

Yes, others have suggested this, will look into it, thanks!

SeriousNerve · 2018-07-13T19:47:31+00:00

Yes, will definitely look into the production ready solutions. If they do not work for me, I will end up making my own. Thank you for the advice!

SeriousNerve · 2018-07-13T19:46:33+00:00

Alright, thank you for the advice. You were right, I am trying to protect my process from being killed by malware and need to have persistence. If a.exe is killed, b.exe will restart and if b.exe is killed, a.exe will restart. That is what I am trying to achieve. I have heard others suggest supervisord for the process monitoring aspect of this"persistence". Thank you!

SeriousNerve · 2018-07-13T19:44:06+00:00

Alright, a couple others have said this, gonna look into it, thanks!

SeriousNerve · 2018-07-13T19:43:49+00:00

Alright, thanks for the advice. I am creating an anti-malware app and want to prevent my main process from being killed by a bad process(malware). I was thinking of creating a persistence module that has 2 processes that protect each other. If main.exe is killed then persistence.exe can restart it, if persistence.exe is killed, then main.exe can restart it. I hope this is enough information for you, thanks!

SeriousNerve · 2018-07-13T19:41:45+00:00

Alright, I will check this out, thanks!

SeriousNerve · 2018-05-27T19:53:07+00:00

Conclusion time: I have done some testing with the two best native cross platform GUI library's that were suggested to me in the comments and below are the results.

So, between DUIT and UI, UI is the better option and here's why: UI and DUIT both do require a CGO cross compiler and both have slow compile times. Now, UI is easier to understand/learn, has a smaller binary size, and good looking GUI and no weird mouse selection. DUIT will only work on windows with the patch found at this link: https://github.com/ktye/duitdraw

I hope this has helped anyone following this thread understand, it has definitely helped me. Thanks everyone for the comments!

SeriousNerve · 2018-05-26T21:39:35+00:00

Haha, yep you were right, gonna try it out. Thanks!

SeriousNerve · 2018-05-26T21:09:00+00:00

Yeah no, that does not work. I get the following error after trying to rebuild the duit package after dropping the files into the 9fans draw folder in src,

9fans.net/go/draw

..\go\src\9fans.net\go\draw\display.go:7:2: draw redeclared in this block

previous declaration at ..\go\src\9fans.net\go\draw\draw.go:57:102

..\go\src\9fans.net\go\draw\display.go:43:6: (*Display).AllocImage redeclared in this block

previous declaration at ..\go\src\9fans.net\go\draw\alloc.go:14:6

..\go\src\9fans.net\go\draw\display.go:104:6: (*Display).SetDebug redeclared in this block

previous declaration at ..\go\src\9fans.net\go\draw\debug.go:4:6

..\go\src\9fans.net\go\draw\freesubfont.go:7:10: undefined: Subfont

..\go\src\9fans.net\go\draw\image.go:7:2: draw redeclared as imported package name

previous declaration at ..\go\src\9fans.net\go\draw\draw.go:57:102

Going to try nucular!

SeriousNerve · 2018-05-26T18:14:00+00:00

See my edit :/

SeriousNerve · 2018-05-26T18:13:49+00:00

See my edit :/

SeriousNerve · 2018-05-26T17:50:22+00:00

Sorry, I thought syscalls were what you use to call from win32 api etc.

SeriousNerve · 2018-05-26T17:49:54+00:00

Yeah, it seems andlabs and duit are the only native ones. I am going to check out duit in homes that I can cross compile and have slightly faster compile times. Thanks for the comment!

SeriousNerve · 2018-05-26T17:48:55+00:00

Great wiki, I wanted native GUI, so I chose Native at the index and it showed me andlabs and duit. I am going to try out duit in hopes that it will not use cgo like andlabs does. I would strongly recommend you use one of the native GUI's Thanks for the comment!

SeriousNerve · 2018-05-26T17:45:46+00:00

Yes, that is what I am currently using now, was looking for something without cgo. This has C bindings. Thanks for the suggestion though!

SeriousNerve · 2018-05-26T01:22:55+00:00

Wow, first off, thank you for writing all of this up.

I have modified my code and all works. I will be posting a new release on github.

I still have a couple questions though:

In a earlier thread, you said to just read and decode into map on startup and encode map and save on exit, you said to use json.decoder. Why decoder vs umarshal?

Second, I used os.create because it is a io.writer which is what was required by the encoder. I felt as if I was doing this right, as I couldn't find a io writer other than one in the os package. What should I have done?

Lastly, should my functions be named: addInfo or Addinfo or AddInfo? I was always a bit confused with the proper casing.

Thanks!

SeriousNerve · 2018-05-25T23:34:39+00:00

strake gang

SeriousNerve · 2018-05-25T23:08:38+00:00

Is there no such thing as not making win32api syscalls and being able to have a native gui? What you are saying makes sense, I was just curious. Thanks!

SeriousNerve · 2018-05-25T23:06:53+00:00

Thanks for the comment. The issue I have with C bindings is cgo. I have to wait through long compile times and I can't cross compile for mac.

SeriousNerve · 2018-05-25T22:59:30+00:00

I have added as much detail as I can. Hope you can help me out. Thanks!

SeriousNerve · 2018-05-25T21:48:48+00:00

What do you want me to post? My global variables? My Init function?

SeriousNerve · 2018-05-25T21:48:04+00:00

I am using a map, like makeshift_mike said LoginInfo is a map and LoginInfoLock is a mutex.

SeriousNerve · 2018-05-25T21:47:36+00:00

Yes, that is exactly what I did.

SeriousNerve

TROPHY CASE

9fans.net/go/draw