remotememory

Documentation

Overview

remotememory provides access to memory space of a process. The ReaderAt interface is used for the basic access, and various convenience functions are provided to help reading specific data types.

Index

• type ProcessVirtualMemory
  • func (vm ProcessVirtualMemory) ReadAt(p []byte, off int64) (int, error)
• type RemoteMemory
  • func NewProcessVirtualMemory(pid util.PID) RemoteMemory
  • func (rm RemoteMemory) Ptr(addr libpf.Address) libpf.Address
  • func (rm RemoteMemory) Read(addr libpf.Address, p []byte) error
  • func (rm RemoteMemory) String(addr libpf.Address) string
  • func (rm RemoteMemory) StringPtr(addr libpf.Address) string
  • func (rm RemoteMemory) Uint16(addr libpf.Address) uint16
  • func (rm RemoteMemory) Uint32(addr libpf.Address) uint32
  • func (rm RemoteMemory) Uint64(addr libpf.Address) uint64
  • func (rm RemoteMemory) Uint8(addr libpf.Address) uint8
  • func (rm RemoteMemory) Valid() bool

Types

type ProcessVirtualMemory

type ProcessVirtualMemory struct {
	// contains filtered or unexported fields
}

ProcessVirtualMemory implements RemoteMemory by using process_vm_readv syscalls to read the remote memory.

func (ProcessVirtualMemory) ReadAt

func (vm ProcessVirtualMemory) ReadAt(p []byte, off int64) (int, error)

type RemoteMemory

type RemoteMemory struct {
	io.ReaderAt
	// Bias is the adjustment for pointers (used to unrelocate pointers in coredump)
	Bias libpf.Address
}

RemoteMemory implements a set of convenience functions to access the remote memory

func NewProcessVirtualMemory

func NewProcessVirtualMemory(pid util.PID) RemoteMemory

NewRemoteMemory returns ProcessVirtualMemory implementation of RemoteMemory.

func (RemoteMemory) Ptr

func (rm RemoteMemory) Ptr(addr libpf.Address) libpf.Address

Ptr reads a native pointer from remote memory

func (RemoteMemory) Read

func (rm RemoteMemory) Read(addr libpf.Address, p []byte) error

Read fills slice p[] with data from remote memory at address addr

func (RemoteMemory) String

func (rm RemoteMemory) String(addr libpf.Address) string

String reads a zero terminated string from remote memory

func (RemoteMemory) StringPtr

func (rm RemoteMemory) StringPtr(addr libpf.Address) string

StringPtr reads a zero terminate string by first dereferencing a string pointer from target memory

func (RemoteMemory) Uint16

func (rm RemoteMemory) Uint16(addr libpf.Address) uint16

Uint16 reads a 16-bit unsigned integer from remote memory

func (RemoteMemory) Uint32

func (rm RemoteMemory) Uint32(addr libpf.Address) uint32

Uint32 reads a 32-bit unsigned integer from remote memory

func (RemoteMemory) Uint64

func (rm RemoteMemory) Uint64(addr libpf.Address) uint64

Uint64 reads a 64-bit unsigned integer from remote memory

func (RemoteMemory) Uint8

func (rm RemoteMemory) Uint8(addr libpf.Address) uint8

Uint8 reads an 8-bit unsigned integer from remote memory

func (RemoteMemory) Valid

func (rm RemoteMemory) Valid() bool

Valid determines if this RemoteMemory instance contains a valid reference to target process