ptrace

Documentation

Index

• Constants
• type ConnectionDetails
• type Fd
• type PTracer
  • func NewPTracer(store Store) PTracer
  • func (t *PTracer) AttachedPIDs() []int
  • func (t *PTracer) Stop()
  • func (t *PTracer) StopTracing(pid int) error
  • func (t *PTracer) TraceProcess(pid int) *process
• type Store

Constants

const (
	READ          = 0
	WRITE         = 1
	OPEN          = 2
	CLOSE         = 3
	STAT          = 4
	MMAP          = 9
	MPROTECT      = 10
	MUNMAP        = 11
	SELECT        = 23
	MADVISE       = 28
	SOCKET        = 41
	CONNECT       = 42
	ACCEPT        = 43
	SENDTO        = 44
	RECVFROM      = 45
	SHUTDOWN      = 48
	CLONE         = 56
	GETTIMEOFDAY  = 96
	GETID         = 186
	FUTEX         = 202
	SETROBUSTLIST = 273
	ACCEPT4       = 288
)

Syscall numbers

const (
	NORMAL = iota
	INSYSCALL
)

States for a given thread

Types

type ConnectionDetails

type ConnectionDetails struct {
	Start int64
	Stop  int64

	FromAddr net.IP
	FromPort uint16
	ToAddr   net.IP
	ToPort   uint16
	// contains filtered or unexported fields
}

ConnectionDetails ...

type Fd

type Fd struct {
	ConnectionDetails

	// Fds are connections, and can have a causal-link to other Fds
	Children []*Fd
	// contains filtered or unexported fields
}

Fd represents a connect and subsequent connections caused by it.

type PTracer

type PTracer struct {
	// contains filtered or unexported fields
}

PTracer ptrace processed and threads

func NewPTracer

func NewPTracer(store Store) PTracer

NewPTracer creates a new ptracer.

func (*PTracer) AttachedPIDs

func (t *PTracer) AttachedPIDs() []int

AttachedPIDs list the currently attached processes.

func (*PTracer) Stop

func (t *PTracer) Stop()

Stop stop stop

func (*PTracer) StopTracing

func (t *PTracer) StopTracing(pid int) error

StopTracing stops tracing all threads for the given pid

func (*PTracer) TraceProcess

func (t *PTracer) TraceProcess(pid int) *process

TraceProcess starts tracing the given pid

type Store

type Store interface {
	RecordConnection(int, *Fd)
}

Store ...