Question

总的来说，我正在使用下面的代码，它产生类似于Windows任务列表的内容。但我想过滤掉用户系统，本地服务和网络服务。然后过滤掉arch arch，session和path列。

print_line
processes = @client.sys.process.get_processes
process_list = processes.to_table('Header' => "%bld %dmag Target Process Info:\n", 'Indent' => 4)

到目前为止，我已经让用户出局了，但我仍然坚持用键拱会话和路径删除哈希。这是原始格式的输出。

[
  {"pid"=>0, "ppid"=>0, "name"=>"[System Process]", "path"=>"", "session"=>4294967295, "user"=>"", "arch"=>""}, 
  {"pid"=>456, "ppid"=>320, "name"=>"explorer.exe", "path"=>"C:\\WINDOWS\\Explorer.EXE", "session"=>0, "user"=>"CLINE\\Administrator", "arch"=>"x86"}, 
  {"pid"=>544, "ppid"=>204, "name"=>"TPAutoConnect.exe", "path"=>"C:\\Program Files\\VMware\\VMware Tools\\TPAutoConnect.exe", "session"=>0, "user"=>"CLINE\\Administrator", "arch"=>"x86"}, 
  {"pid"=>1096, "ppid"=>456, "name"=>"vmtoolsd.exe", "path"=>"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe", "session"=>0, "user"=>"CLINE\\Administrator", "arch"=>"x86"}, 
  {"pid"=>180, "ppid"=>456, "name"=>"rundll32.exe", "path"=>"C:\\WINDOWS\\system32\\rundll32.exe", "session"=>0, "user"=>"CLINE\\Administrator", "arch"=>"x86"}, 
  {"pid"=>1208, "ppid"=>724, "name"=>"logon.scr", "path"=>"C:\\WINDOWS\\System32\\logon.scr", "session"=>0, "user"=>"CLINE\\Administrator", "arch"=>"x86"}
]

到目前为止，这是我的代码。

print_line
processes = @client.sys.process.get_processes
blacklist = ["NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\LOCAL SERVICE", "NT AUTHORITY\\NETWORK SERVICE"]
filtered = processes.reject {|h| blacklist.include? h['user']}
print_status (filtered)

原版也有使用to_table的输出，但我好像打破了那个？

Answer 1

所以，我的理解是你想要

pid，ppid，name，user。

使用ActiveSupport，您可以就地对它们进行切片：

processes = @client.sys.process.get_processes
blacklist = ["NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\LOCAL SERVICE", "NT AUTHORITY\\NETWORK SERVICE"]
filtered = processes.map!{|i| i.slice!("pid", "ppid", "name", "user")}.reject {|h| blacklist.include? h['user']}
print_status (filtered)

你想做什么？

Answer 2

使用Hash#reject从Hash中删除满足某些条件的键值对，以获得新的哈希值。

filtered.map{|p| p.reject{|k, _| %w(arch session path).include?(k)} }

其他选项包括Hash#reject!，Hash#delete

如何在Ruby中删除数组中的哈希？

2 个答案: