procmon

type DDProcessNotification struct {
	Size              uint64
	SizeNeeded        uint64
	ProcessId         uint64
	NotifyType        uint64
	ParentProcessId   uint64
	CreatingProcessId uint64
	CreatingThreadId  uint64
	ImageFileLen      uint64
	ImageFileOffset   uint64
	CommandLineLen    uint64
	CommandLineOffset uint64
	SidLen            uint64
	SidOffset         uint64
}

type DDProcessNotifyType uint32

type DDProcmonStats struct {
	ProcessStartCount       uint64
	ProcessStopCount        uint64
	MissedNotifications     uint64
	AllocationFailures      uint64
	WorkItemFailures        uint64
	ReadBufferToSmallErrors uint64
}

type ProcessStartNotification struct {
	Pid               uint64
	PPid              uint64
	CreatingProcessId uint64
	CreatingThreadId  uint64
	OwnerSidString    string
	ImageFile         string
	CmdLine           string
	// if this is nonzero, functions as notification to
	// the probe that the buffer size isn't large enough
	RequiredSize uint32
}

type ProcessStopNotification struct {
	Pid uint64
}

type WinProcmon struct {
	// contains filtered or unexported fields
}