ptrace

Documentation

Index

• type TracedProgram
  • func Trace(pid int, logger logr.Logger) (*TracedProgram, error)
  • func (p *TracedProgram) Detach() error
  • func (p *TracedProgram) Mmap(length uint64, fd uint64) (uint64, error)
  • func (p *TracedProgram) Pid() int
  • func (p *TracedProgram) Protect() error
  • func (p *TracedProgram) Restore() error
  • func (p *TracedProgram) Step() error
  • func (p *TracedProgram) Syscall(number uint64, args ...uint64) (uint64, error)
  • func (p *TracedProgram) Wait() error

Types

type TracedProgram

type TracedProgram struct {
	// contains filtered or unexported fields
}

TracedProgram is a program traced by ptrace

func Trace

func Trace(pid int, logger logr.Logger) (*TracedProgram, error)

Trace ptrace all threads of a process

func (*TracedProgram) Detach

func (p *TracedProgram) Detach() error

Detach detaches from all threads of the processes

func (*TracedProgram) Mmap

func (p *TracedProgram) Mmap(length uint64, fd uint64) (uint64, error)

Mmap runs mmap syscall

func (*TracedProgram) Pid

func (p *TracedProgram) Pid() int

Pid return the pid of traced program

func (*TracedProgram) Protect

func (p *TracedProgram) Protect() error

Protect will backup regs and rip into fields

func (*TracedProgram) Restore

func (p *TracedProgram) Restore() error

Restore will restore regs and rip from fields

func (*TracedProgram) Step

func (p *TracedProgram) Step() error

Step moves one step forward

func (*TracedProgram) Syscall

func (p *TracedProgram) Syscall(number uint64, args ...uint64) (uint64, error)

Syscall runs a syscall at main thread of process

func (*TracedProgram) Wait

func (p *TracedProgram) Wait() error

Wait waits until the process stops