ftrace

README

FTRACE kernel framework library for Go

ftrace utilizes the FTRACE kernel framework in order to trace system calls and kernel events from user space.

Installation

To install this package, you need to install Go and setup your Go workspace on your computer. The simplest way to install the library is to run:

$ go get -u github.com/evilsocket/ftrace

Documentation

See API documentation for package and API descriptions and find examples in the this directory.

License

This package was made with ♥ by Simone Margaritelli and it's released under the GPL 3 license.

Documentation

Overview

Package ftrace utilizes the FTRACE kernel framework in order to trace system calls and kernel events from user space.

Index

• Constants
• func Available() bool
• type Event
  • func (e Event) Argv() []string
  • func (e Event) String() string
• type Probe
  • func NewProbe(name string, syscall string, subEvents []string) *Probe
  • func (p *Probe) Disable() error
  • func (p *Probe) Enable() (err error)
  • func (p *Probe) Enabled() bool
  • func (p *Probe) Events() <-chan Event
  • func (p *Probe) Reset() error

Constants

const Version = "1.2.0"

Version represents the version of this package.

Functions

func Available

func Available() bool

Available returns true if FTRACE is available on this system, otherwise false.

Types

type Event

type Event struct {
	// process id for this event
	PID int
	// name of this event
	Name string
	// true if this is a syscall event or false of any sub event
	IsSyscall bool
	// argv if this is a syscall, otherwise just the event's data map
	Args map[string]string
}

Event represents a single FTRACE notification.

func (Event) Argv

func (e Event) Argv() []string

Argv returns a list of the argument values of this event.

func (Event) String

func (e Event) String() string

String returns a string representation of this event.

type Probe

type Probe struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

Probe represents a FTRACE probe to a system call and optional sub events.

func NewProbe

func NewProbe(name string, syscall string, subEvents []string) *Probe

NewProbe creates a new probe with a custom name for the given syscall and optional sub events.

func (*Probe) Disable

func (p *Probe) Disable() error

Disable disables this probe and stops its async worker.

func (*Probe) Enable

func (p *Probe) Enable() (err error)

Enable enables this probe and starts its async worker routine in order to read FTRACE events.

func (*Probe) Enabled

func (p *Probe) Enabled() bool

Enabled return true if this probe is enabled and running, otherwise false.

func (*Probe) Events

func (p *Probe) Events() <-chan Event

Events returns a channel where FTRACE events will be written by this Probe worker routine.

func (*Probe) Reset

func (p *Probe) Reset() error

Reset disables this probe.