target

Documentation

Index

• Variables
• type Breakpoint
• type Breakpoints
  • func (b Breakpoints) Len() int
  • func (b Breakpoints) Less(i, j int) bool
  • func (b Breakpoints) Swap(i, j int)
• type DebuggedProcess
  • func AttachTargetProcess(pid int) (p *DebuggedProcess, err error)
  • func NewDebuggedProcess(cmd string, args []string, kind Kind) (*DebuggedProcess, error)
  • func (p *DebuggedProcess) AddBreakpoint(addr uintptr) (*Breakpoint, error)
  • func (p *DebuggedProcess) Backtrace() error
  • func (p *DebuggedProcess) BacktraceX() error
  • func (p *DebuggedProcess) ClearAll() error
  • func (p *DebuggedProcess) ClearBreakpoint(addr uintptr) (*Breakpoint, error)
  • func (p *DebuggedProcess) Continue() error
  • func (p *DebuggedProcess) ContinueX() error
  • func (p *DebuggedProcess) Detach() error
  • func (p *DebuggedProcess) Disassemble(addr, max uint64, syntax string) error
  • func (p *DebuggedProcess) DisassembleSingleInstruction(addr uint64) (*x86asm.Inst, error)
  • func (p *DebuggedProcess) ExecPtrace(fn func() error) error
  • func (p *DebuggedProcess) Frame(idx int) error
  • func (p *DebuggedProcess) IsBreakpoint(addr uintptr) bool
  • func (p *DebuggedProcess) ListBreakpoints()
  • func (p *DebuggedProcess) Next() error
  • func (p *DebuggedProcess) NextX() error
  • func (p *DebuggedProcess) PrintVariable(variable string) error
  • func (p *DebuggedProcess) ProcessStart() error
  • func (p *DebuggedProcess) ReadMemory(addr uintptr, buf []byte) (int, error)
  • func (p *DebuggedProcess) ReadRegister() (*syscall.PtraceRegs, error)
  • func (p *DebuggedProcess) SingleStep() (*syscall.WaitStatus, error)
  • func (p *DebuggedProcess) StopPtrace()
  • func (p *DebuggedProcess) WriteMemory(addr uintptr, value []byte) error
  • func (p *DebuggedProcess) WriteRegister(regs *syscall.PtraceRegs) error
• type Kind
• type Thread

Variables

var (
	ErrBreakpointNotExisted = errors.New("breakpoint not existed")
)

Types

type Breakpoint

type Breakpoint struct {
	ID      uint64  // 断点编号
	Addr    uintptr // 断点地址
	Pos     string  // 源文件位置
	Orig    byte    // 原内存数据
	Cond    string  // 条件表达式
	Enabled bool    // 断点是否启用
}

Breakpoint 断点信息

type Breakpoints

type Breakpoints []*Breakpoint

Breakpoints 所有的断点信息

func (Breakpoints) Len

func (b Breakpoints) Len() int

Len 返回长度

func (Breakpoints) Less

func (b Breakpoints) Less(i, j int) bool

Less 检查b[i]是否小于b[j]

func (Breakpoints) Swap

func (b Breakpoints) Swap(i, j int)

Swap 交换b[i]和b[j]

type DebuggedProcess

type DebuggedProcess struct {
	Process *os.Process     // 进程信息
	Threads map[int]*Thread // 包含的线程列表,k=tid,v=thread

	Command string   // 进程启动命令，方便重启调试
	Args    []string // 进程启动参数，方便重启调试
	Kind    Kind     // 发起调试的类型

	BInfo *symbol.BinaryInfo // 符号层操作

	Breakpoints map[uintptr]*Breakpoint // 已经添加的断点
	// contains filtered or unexported fields
}

DebuggedProcess 被调试进程信息

var DBPProcess *DebuggedProcess

func AttachTargetProcess

func AttachTargetProcess(pid int) (p *DebuggedProcess, err error)

AttachTargetProcess trace一个目标进程（准确地说是线程）

func NewDebuggedProcess

func NewDebuggedProcess(cmd string, args []string, kind Kind) (*DebuggedProcess, error)

NewDebuggedProcess 创建一个待调试进程

func (*DebuggedProcess) AddBreakpoint

func (p *DebuggedProcess) AddBreakpoint(addr uintptr) (*Breakpoint, error)

AddBreakpoint 在地址addr处添加断点，返回新创建的断点

func (*DebuggedProcess) Backtrace

func (p *DebuggedProcess) Backtrace() error

Backtrace 获取调用栈信息

use .gopclntab, .gosymtab to build the mappings btw PC and fileLineNo, use regs.BP() to read the caller's BP and return address, then we could build the backtrace

note: .gopclntab, .gosymtab only works for pure go program, not for cgo.

func (*DebuggedProcess) BacktraceX

func (p *DebuggedProcess) BacktraceX() error

BacktraceX 获取调用栈信息

use .(z)debug_line to build the mappings btw PC and fileLineNo, use regs.BP() to read the caller's BP and return address, then we could build the backtrace.

func (*DebuggedProcess) ClearAll

func (p *DebuggedProcess) ClearAll() error

ClearAll 删除所有已添加的断点

func (*DebuggedProcess) ClearBreakpoint

func (p *DebuggedProcess) ClearBreakpoint(addr uintptr) (*Breakpoint, error)

ClearBreakpoint 删除addr处的断点

func (*DebuggedProcess) Continue

func (p *DebuggedProcess) Continue() error

func (*DebuggedProcess) ContinueX

func (p *DebuggedProcess) ContinueX() error

ContinueX 执行到下一个断点处，考虑所有线程的问题

func (*DebuggedProcess) Detach

func (p *DebuggedProcess) Detach() error

func (*DebuggedProcess) Disassemble

func (p *DebuggedProcess) Disassemble(addr, max uint64, syntax string) error

Disassemble 反汇编地址addr处的指令

func (*DebuggedProcess) DisassembleSingleInstruction

func (p *DebuggedProcess) DisassembleSingleInstruction(addr uint64) (*x86asm.Inst, error)

func (*DebuggedProcess) ExecPtrace

func (p *DebuggedProcess) ExecPtrace(fn func() error) error

func (*DebuggedProcess) Frame

func (p *DebuggedProcess) Frame(idx int) error

Frame 返回${idx}th个栈帧的信息

func (*DebuggedProcess) IsBreakpoint

func (p *DebuggedProcess) IsBreakpoint(addr uintptr) bool

func (*DebuggedProcess) ListBreakpoints

func (p *DebuggedProcess) ListBreakpoints()

ListBreakpoints 列出所有断点

func (*DebuggedProcess) Next

func (p *DebuggedProcess) Next() error

Deprecated too slow

func (*DebuggedProcess) NextX

func (p *DebuggedProcess) NextX() error

func (*DebuggedProcess) PrintVariable

func (p *DebuggedProcess) PrintVariable(variable string) error

func (*DebuggedProcess) ProcessStart

func (p *DebuggedProcess) ProcessStart() error

ProcessStart 启动被调试进程

func (*DebuggedProcess) ReadMemory

func (p *DebuggedProcess) ReadMemory(addr uintptr, buf []byte) (int, error)

ReadMemory 读取内存地址addr处的数据，并存储到buf中，函数返回实际读取的字节数

func (*DebuggedProcess) ReadRegister

func (p *DebuggedProcess) ReadRegister() (*syscall.PtraceRegs, error)

ReadRegister 读取寄存器的数据

func (*DebuggedProcess) SingleStep

func (p *DebuggedProcess) SingleStep() (*syscall.WaitStatus, error)

SingleStep 执行一条指令

func (*DebuggedProcess) StopPtrace

func (p *DebuggedProcess) StopPtrace()

func (*DebuggedProcess) WriteMemory

func (p *DebuggedProcess) WriteMemory(addr uintptr, value []byte) error

SetVariable 设置内存地址addr处的值为value

func (*DebuggedProcess) WriteRegister

func (p *DebuggedProcess) WriteRegister(regs *syscall.PtraceRegs) error

WriteRegister 设置寄存器reg的值为value

type Kind

type Kind int

Kind 调试发起类型

const (
	DEBUG Kind = iota
	EXEC
	ATTACH
)

type Thread

type Thread struct {
	Tid     int              // thread ID
	Process *DebuggedProcess // process this thread belongs to
}

Thread 线程信息