Suspend process when dumping, flag for filtering out paths to dump

jmap_dumper/Cargo.toml

@@ -43,7 +43,7 @@ jmap = { version = "0.1.1", path = "../jmap" }
 usmap = { version = "0.1.1", path = "../usmap" }
 
 [target.'cfg(target_os = "windows")'.dependencies]
-windows = { version = "0.62.2", features = ["Win32_System_Diagnostics_ToolHelp", "Win32_System_Diagnostics_Debug"] }
+windows = { version = "0.62.2", features = ["Win32_System_Diagnostics_ToolHelp", "Win32_System_Diagnostics_Debug", "Win32_System_Threading"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 libc = "0.2"

jmap_dumper/src/lib.rs

@@ -329,6 +329,8 @@ pub struct DumpOptions {
     pub names: bool,
     /// Print struct layouts before dumping
     pub verbose: bool,
+    /// Filter out objects whose path contains any of these substrings
+    pub filter_out_paths: Vec<String>,
 }
 
 pub fn dump(
@@ -359,6 +361,8 @@ async fn dump_async(
                     connect(mem, &image, overrides, struct_info, options.verbose).await?
                 }
             };
+            #[cfg(any(target_os = "windows", target_os = "linux"))]
+            let _suspend_guard = mem::ProcessSuspendGuard::suspend(pid)?;
             dump_inner(ctx, &source_name, options).await
         }
         Input::Dump(path) => {
@@ -733,8 +737,18 @@ async fn dump_one(
 
     let path = obj.path().await?;
 
+    let filtered = options.filter_out_paths.iter().any(|f| path.contains(f.as_str()));
+
     if options.verbose {
-        eprintln!("[{i}/{num}] {path}");
+        if filtered {
+            eprintln!("[{i}/{num}] [filtered] {path}");
+        } else {
+            eprintln!("[{i}/{num}] {path}");
+        }
+    }
+
+    if filtered {
+        return Ok(None);
     }
 
     Ok(read_object_type(obj, &path, options)
@@ -810,11 +824,14 @@ pub async fn read_object_type(
     path: &str,
     options: &DumpOptions,
 ) -> Result<Option<ObjectType>> {
-    let class = obj.class_private().read().await?;
-
     if !options.all && !path.starts_with("/Script/") {
         return Ok(None);
     }
+    if options.filter_out_paths.iter().any(|f| path.contains(f.as_str())) {
+        return Ok(None);
+    }
+
+    let class = obj.class_private().read().await?;
     let object_flags = obj.object_flags().read().await?;
     let is_basic_object = object_flags.contains(EObjectFlags::RF_ArchetypeObject)
         || object_flags.contains(EObjectFlags::RF_ClassDefaultObject);

jmap_dumper/src/main.rs

@@ -69,6 +69,10 @@ struct Cli {
     #[arg(long)]
     all: bool,
 
+    /// Filter out objects whose path contains the given substring (can be specified multiple times)
+    #[arg(long, value_name = "PATH_PREFIX")]
+    filter_out_paths: Vec<String>,
+
     /// Dump FName table
     #[arg(long)]
     names: bool,
@@ -127,6 +131,7 @@ fn main() -> Result<()> {
         all: cli.all,
         names: cli.names,
         verbose: cli.verbose,
+        filter_out_paths: cli.filter_out_paths,
     };
 
     let overrides = ConfigOverrides {

jmap_dumper/src/mem.rs

@@ -583,3 +583,91 @@ impl<T> Ptr<Option<Ptr<T>>> {
         })
     }
 }
+
+#[cfg(target_os = "windows")]
+pub struct ProcessSuspendGuard {
+    thread_handles: Vec<windows::Win32::Foundation::HANDLE>,
+}
+
+#[cfg(target_os = "windows")]
+impl ProcessSuspendGuard {
+    pub fn suspend(pid: i32) -> Result<Self> {
+        use windows::Win32::Foundation::{CloseHandle, HANDLE};
+        use windows::Win32::System::Diagnostics::ToolHelp::{
+            CreateToolhelp32Snapshot, Thread32First, Thread32Next, TH32CS_SNAPTHREAD, THREADENTRY32,
+        };
+        use windows::Win32::System::Threading::{OpenThread, SuspendThread, THREAD_SUSPEND_RESUME};
+
+        let snapshot = unsafe { CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)? };
+
+        let mut thread_handles: Vec<HANDLE> = Vec::new();
+        let mut entry = THREADENTRY32 {
+            dwSize: std::mem::size_of::<THREADENTRY32>() as u32,
+            ..Default::default()
+        };
+
+        unsafe {
+            if Thread32First(snapshot, &mut entry).is_ok() {
+                loop {
+                    if entry.th32OwnerProcessID == pid as u32 {
+                        if let Ok(handle) =
+                            OpenThread(THREAD_SUSPEND_RESUME, false, entry.th32ThreadID)
+                        {
+                            SuspendThread(handle);
+                            thread_handles.push(handle);
+                        }
+                    }
+                    entry.dwSize = std::mem::size_of::<THREADENTRY32>() as u32;
+                    if Thread32Next(snapshot, &mut entry).is_err() {
+                        break;
+                    }
+                }
+            }
+            let _ = CloseHandle(snapshot);
+        }
+
+        eprintln!(
+            "Suspended {} thread(s) of pid {}",
+            thread_handles.len(),
+            pid
+        );
+        Ok(Self { thread_handles })
+    }
+}
+
+#[cfg(target_os = "windows")]
+impl Drop for ProcessSuspendGuard {
+    fn drop(&mut self) {
+        use windows::Win32::Foundation::CloseHandle;
+        use windows::Win32::System::Threading::ResumeThread;
+        for &handle in &self.thread_handles {
+            unsafe {
+                ResumeThread(handle);
+                let _ = CloseHandle(handle);
+            }
+        }
+        eprintln!("Resumed {} thread(s)", self.thread_handles.len());
+    }
+}
+
+#[cfg(target_os = "linux")]
+pub struct ProcessSuspendGuard {
+    pid: i32,
+}
+
+#[cfg(target_os = "linux")]
+impl ProcessSuspendGuard {
+    pub fn suspend(pid: i32) -> Result<Self> {
+        unsafe { libc::kill(pid, libc::SIGSTOP) };
+        eprintln!("Suspended pid {pid}");
+        Ok(Self { pid })
+    }
+}
+
+#[cfg(target_os = "linux")]
+impl Drop for ProcessSuspendGuard {
+    fn drop(&mut self) {
+        unsafe { libc::kill(self.pid, libc::SIGCONT) };
+        eprintln!("Resumed pid {}", self.pid);
+    }
+}