Documentation
¶
Overview ¶
remotememory provides access to memory space of a process. The ReaderAt interface is used for the basic access, and various convenience functions are provided to help reading specific data types.
Index ¶
- type ProcessVirtualMemory
- type RecordingReader
- type RemoteMemory
- func (rm RemoteMemory) Ptr(addr libpf.Address) libpf.Address
- func (rm RemoteMemory) Read(addr libpf.Address, p []byte) error
- func (rm RemoteMemory) Reader(addr libpf.Address, chunkSize uint) *RecordingReader
- func (rm RemoteMemory) String(addr libpf.Address) string
- func (rm RemoteMemory) StringPtr(addr libpf.Address) string
- func (rm RemoteMemory) Uint16(addr libpf.Address) uint16
- func (rm RemoteMemory) Uint32(addr libpf.Address) uint32
- func (rm RemoteMemory) Uint64(addr libpf.Address) uint64
- func (rm RemoteMemory) Uint8(addr libpf.Address) uint8
- func (rm RemoteMemory) Valid() bool
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ProcessVirtualMemory ¶
type ProcessVirtualMemory struct {
// contains filtered or unexported fields
}
ProcessVirtualMemory implements RemoteMemory by using process_vm_readv syscalls to read the remote memory.
type RecordingReader ¶
type RecordingReader struct {
// contains filtered or unexported fields
}
RecordingReader allows reading data from the remote process using io.ReadByte interface. It provides basic buffering by reading memory in pieces of 'chunk' bytes and it also records all read memory in a backing buffer to be later stored as a whole.
func (*RecordingReader) GetBuffer ¶
func (rr *RecordingReader) GetBuffer() []byte
GetBuffer returns all the data so far as a single slice.
func (*RecordingReader) ReadByte ¶
func (rr *RecordingReader) ReadByte() (byte, error)
ReadByte implements io.ByteReader interface to read memory single byte at a time.
type RemoteMemory ¶
type RemoteMemory struct {
io.ReaderAt
// Bias is the adjustment for pointers (used to unrelocate pointers in coredump)
Bias libpf.Address
}
RemoteMemory implements a set of convenience functions to access the remote memory
func NewProcessVirtualMemory ¶
func NewProcessVirtualMemory(pid libpf.PID) RemoteMemory
NewRemoteMemory returns ProcessVirtualMemory implementation of RemoteMemory.
func (RemoteMemory) Ptr ¶
func (rm RemoteMemory) Ptr(addr libpf.Address) libpf.Address
Ptr reads a native pointer from remote memory
func (RemoteMemory) Read ¶
func (rm RemoteMemory) Read(addr libpf.Address, p []byte) error
Read fills slice p[] with data from remote memory at address addr
func (RemoteMemory) Reader ¶
func (rm RemoteMemory) Reader(addr libpf.Address, chunkSize uint) *RecordingReader
Reader returns a RecordingReader to read and record data from given start.
func (RemoteMemory) String ¶
func (rm RemoteMemory) String(addr libpf.Address) string
String reads a zero terminated string from remote memory
func (RemoteMemory) StringPtr ¶
func (rm RemoteMemory) StringPtr(addr libpf.Address) string
StringPtr reads a zero terminate string by first dereferencing a string pointer from target memory
func (RemoteMemory) Uint16 ¶
func (rm RemoteMemory) Uint16(addr libpf.Address) uint16
Uint16 reads a 16-bit unsigned integer from remote memory
func (RemoteMemory) Uint32 ¶
func (rm RemoteMemory) Uint32(addr libpf.Address) uint32
Uint32 reads a 32-bit unsigned integer from remote memory
func (RemoteMemory) Uint64 ¶
func (rm RemoteMemory) Uint64(addr libpf.Address) uint64
Uint64 reads a 64-bit unsigned integer from remote memory
func (RemoteMemory) Uint8 ¶
func (rm RemoteMemory) Uint8(addr libpf.Address) uint8
Uint8 reads an 8-bit unsigned integer from remote memory
func (RemoteMemory) Valid ¶
func (rm RemoteMemory) Valid() bool
Valid determines if this RemoteMemory instance contains a valid reference to target process
Source Files