symbol

Documentation

Index

• Variables
• type KernelSymbol
• type KernelSymbolTable
  • func NewKernelSymbolTable(lazyNameLookup bool, requiredDataSymbolsOnly bool, ...) (*KernelSymbolTable, error)
  • func NewKernelSymbolTableFromReader(reader io.Reader, lazyNameLookup bool, requiredDataSymbolsOnly bool, ...) (*KernelSymbolTable, error)
  • func (kst *KernelSymbolTable) ForEachSymbol(callback func(*KernelSymbol))
  • func (kst *KernelSymbolTable) GetPotentiallyHiddenSymbolByAddr(addr uint64) []*KernelSymbol
  • func (kst *KernelSymbolTable) GetSymbolByAddr(addr uint64) ([]*KernelSymbol, error)
  • func (kst *KernelSymbolTable) GetSymbolByName(name string) ([]*KernelSymbol, error)
  • func (kst *KernelSymbolTable) GetSymbolByOwnerAndName(owner, name string) ([]*KernelSymbol, error)
• type Symbol
• type SymbolTable
  • func NewSymbolTable[T Symbol[T]](lazyNameLookup bool) *SymbolTable[T]
  • func (st *SymbolTable[T]) AddSymbols(symbols []*T)
  • func (st *SymbolTable[T]) ForEachSymbol(callback func(symbol *T))
  • func (st *SymbolTable[T]) LookupByAddressContains(address uint64) (*T, error)
  • func (st *SymbolTable[T]) LookupByAddressExact(address uint64) ([]*T, error)
  • func (st *SymbolTable[T]) LookupByName(name string) ([]*T, error)

Variables

var ErrSymbolNotFound = errors.New("symbol not found")

Types

type KernelSymbol

type KernelSymbol struct {
	Name    string
	Address uint64
	Owner   string
}

KernelSymbol is a friendly representation of a kernel symbol.

type KernelSymbolTable

type KernelSymbolTable struct {
	// contains filtered or unexported fields
}

func NewKernelSymbolTable

func NewKernelSymbolTable(lazyNameLookup bool, requiredDataSymbolsOnly bool, requiredDataSymbols ...string) (*KernelSymbolTable, error)

Creates a new KernelSymbolTable that will be populated from /proc/kallsyms. If lazyNameLookup is true, the mapping from name to symbol will be populated only when a failed lookup occurs. This reduces memory footprint at the cost of the time it takes to lookup a symbol name for the first time. If requiredDataSymbolsOnly is true, only the data symbols passed in the optional requiredDataSymbols argument will be added.

func NewKernelSymbolTableFromReader

func NewKernelSymbolTableFromReader(reader io.Reader, lazyNameLookup bool, requiredDataSymbolsOnly bool, requiredDataSymbols ...string) (*KernelSymbolTable, error)

Creates a new KernelSymbolTable that will be populated from a reader. If lazyNameLookup is true, the mapping from name to symbol will be populated only when a failed lookup occurs. This reduces memory footprint at the cost of the time it takes to lookup a symbol name for the first time. If requiredDataSymbolsOnly is true, only the data symbols passed in the optional requiredDataSymbols argument will be added.

func (*KernelSymbolTable) ForEachSymbol

func (kst *KernelSymbolTable) ForEachSymbol(callback func(*KernelSymbol))

func (*KernelSymbolTable) GetPotentiallyHiddenSymbolByAddr

func (kst *KernelSymbolTable) GetPotentiallyHiddenSymbolByAddr(addr uint64) []*KernelSymbol

GetPotentiallyHiddenSymbolByAddr returns all the symbols with the given address, or if none are found, a fake symbol with the "hidden" owner.

func (*KernelSymbolTable) GetSymbolByAddr

func (kst *KernelSymbolTable) GetSymbolByAddr(addr uint64) ([]*KernelSymbol, error)

GetSymbolByAddr returns all the symbols with the given address.

func (*KernelSymbolTable) GetSymbolByName

func (kst *KernelSymbolTable) GetSymbolByName(name string) ([]*KernelSymbol, error)

GetSymbolByName returns all the symbols with the given name.

func (*KernelSymbolTable) GetSymbolByOwnerAndName

func (kst *KernelSymbolTable) GetSymbolByOwnerAndName(owner, name string) ([]*KernelSymbol, error)

GetSymbolByOwnerAndName returns all the symbols with the given owner and name.

type Symbol

type Symbol[T any] interface {
	// Name returns the symbol's name
	Name() string
	// Address returns the base address of the symbol
	Address() uint64
	// Contains returns whether a given address belongs to the symbol's
	// address range, which is defined by the symbol's implementation
	Contains(address uint64) bool
	interfaces.Cloner[T]
}

The Symbol interface defines what is needed from a symbol implementation in order to facilitate the lookup functionalities provided by SymbolTable. Implementations of Symbol can hold various types of information relevant to the type of symbol they represent.

type SymbolTable

type SymbolTable[T Symbol[T]] struct {
	// contains filtered or unexported fields
}

SymbolTable is used to hold information about symbols (mapping from symbolic names used in code to their address) in a certain executable. It can be used to hold symbols from an ELF binary, or symbols of the entire kernel and its modules. It provides functions to lookup symbols by address and name.

func NewSymbolTable

func NewSymbolTable[T Symbol[T]](lazyNameLookup bool) *SymbolTable[T]

Creates a new SymbolTable. If lazyNameLookup is true, the mapping from name to symbol will be populated only when a failed lookup occurs. This reduces memory footprint at the cost of the time it takes to lookup a symbol name for the first time.

func (*SymbolTable[T]) AddSymbols

func (st *SymbolTable[T]) AddSymbols(symbols []*T)

Adds a slice of symbols to the symbol table.

func (*SymbolTable[T]) ForEachSymbol

func (st *SymbolTable[T]) ForEachSymbol(callback func(symbol *T))

func (*SymbolTable[T]) LookupByAddressContains

func (st *SymbolTable[T]) LookupByAddressContains(address uint64) (*T, error)

Find the symbol which contains the given address. If multiple symbols at different addresses contain the requested address, the symbol with the highest address will be returned. If multiple symbols at the same address contain the requested address, one of them will be returned, but there is no guarantee which one. This function assumes that symbols don't overlap in a way that a symbol with a smaller address contains the requested address while a symbol with a larger address (but still smaller that requested) doesn't contain it. For example, the following situation is assumed to be impossible:

        Requested Address
                 |
                 |
 +---------------+--+
 |Symbol 1       |  |
 +---------------+--+
    +--------+   |
    |Symbol 2|   |
    +--------+   v
<---------------------->

Smaller Larger Address Address

If the above situation happens, no symbol will be returned.

func (*SymbolTable[T]) LookupByAddressExact

func (st *SymbolTable[T]) LookupByAddressExact(address uint64) ([]*T, error)

Lookup a symbol in the table by its exact address. Because there may be multiple symbols at the same address, a slice of all matching symbols is returned.

func (*SymbolTable[T]) LookupByName

func (st *SymbolTable[T]) LookupByName(name string) ([]*T, error)

Lookup a symbol in the table by its name. Because there may be multiple symbols with the same name, a slice of all matching symbols is returned.