elfparser

Documentation

Index

• func NullTerminatedStringToString(val []byte) string
• type BPFInsn
• type ELFContext
  • func LoadBpfFile(path string) (*ELFContext, error)
• type ELFMap
• type ELFProgram
• type ELFSection

Functions

func NullTerminatedStringToString

func NullTerminatedStringToString(val []byte) string

Types

type BPFInsn

type BPFInsn struct {
	Code   uint8 // Opcode
	DstReg uint8 // 4 bits: destination register, r0-r10
	SrcReg uint8 // 4 bits: source register, r0-r10
	Off    int16 // Signed offset
	Imm    int32 // Immediate constant
}

https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/bpf.h#L71

type ELFContext

type ELFContext struct {
	// .elf will have multiple sections and maps
	Section map[string]ELFSection // Indexed by section type
	Maps    map[string]ELFMap     // Index by map name
}

Ref:https://github.com/torvalds/linux/blob/v5.10/samples/bpf/bpf_load.c

func LoadBpfFile

func LoadBpfFile(path string) (*ELFContext, error)

type ELFMap

type ELFMap struct {
	// return map type, map FD and pinPath
	MapType int
	MapFD   int
	PinPath string
}

type ELFProgram

type ELFProgram struct {
	// return program name, prog FD and pinPath
	ProgFD  int
	PinPath string
}

type ELFSection

type ELFSection struct {
	// Each sections will have a program but a single section type can have multiple programs
	// like tc_cls
	Programs map[string]ELFProgram // Index by program name
}