ptrace

Documentation

Index

• type TracedProgram
  • func NewTracedProgram(pid int, logger logr.Logger) (*TracedProgram, error)
  • func (p *TracedProgram) Detach() error
  • func (p *TracedProgram) Mmap(length uint64, fd uint64) (uint64, error)
  • func (p *TracedProgram) Pid() int
  • func (p *TracedProgram) Protect() error
  • func (p *TracedProgram) Restore() error
  • func (p *TracedProgram) Step() error
  • func (p *TracedProgram) Syscall(number uint64, args ...uint64) (uint64, error)
  • func (p *TracedProgram) Wait() error

Types

type TracedProgram

type TracedProgram struct {
	// contains filtered or unexported fields
}

TracedProgram is a program traced by ptrace.

func NewTracedProgram

func NewTracedProgram(pid int, logger logr.Logger) (*TracedProgram, error)

NewTracedProgram ptrace all threads of a process.

func (*TracedProgram) Detach

func (p *TracedProgram) Detach() error

Detach detaches from all threads of the processes.

func (*TracedProgram) Mmap

func (p *TracedProgram) Mmap(length uint64, fd uint64) (uint64, error)

Mmap runs mmap syscall.

func (*TracedProgram) Pid

func (p *TracedProgram) Pid() int

Pid return the pid of traced program.

func (*TracedProgram) Protect

func (p *TracedProgram) Protect() error

Protect will backup regs and rip into fields.

func (*TracedProgram) Restore

func (p *TracedProgram) Restore() error

Restore will restore regs and rip from fields.

func (*TracedProgram) Step

func (p *TracedProgram) Step() error

Step moves one step forward.

func (*TracedProgram) Syscall

func (p *TracedProgram) Syscall(number uint64, args ...uint64) (uint64, error)

Syscall runs a syscall at main thread of process.

func (*TracedProgram) Wait

func (p *TracedProgram) Wait() error

Wait waits until the process stops.