31 lines
635 B
Go
31 lines
635 B
Go
|
//go:build !windows
|
||
|
|
|
||
|
|
package main
|
||
|
|
|
||
|
|
import (
|
||
|
|
"os"
|
||
|
|
"path/filepath"
|
||
|
|
)
|
||
|
|
|
||
|
|
// isRunningInMemory returns true when the agent is executing as
|
||
|
|
// in-memory shellcode (e.g. Linux memfd_create / execveat stub).
|
||
|
|
// On Linux the memfd path cannot be stat'd as a regular file.
|
||
|
|
func isRunningInMemory() bool {
|
||
|
|
exePath, err := os.Executable()
|
||
|
|
if err != nil {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
if realPath, err := filepath.EvalSymlinks(exePath); err == nil {
|
||
|
|
exePath = realPath
|
||
|
|
}
|
||
|
|
absPath, err := filepath.Abs(exePath)
|
||
|
|
if err != nil {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
info, err := os.Stat(absPath)
|
||
|
|
if err != nil || !info.Mode().IsRegular() {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
return false
|
||
|
|
}
|