process

type CoredumpFile struct {

	// Name is the mapped file's name
	Name string
	// Mappings contains mappings regarding this file
	Mappings []CoredumpMapping
	// Base is the virtual address where this file is loaded
	Base uint64
	// contains filtered or unexported fields
}

type CoredumpMapping struct {
	// Corresponding PT_LOAD segment
	Prog *pfelf.Prog
	// File is the backing file for this mapping
	File *CoredumpFile
	// FileOffset is the offset in the original backing file
	FileOffset uint64
}

type CoredumpProcess struct {
	*pfelf.File
	// contains filtered or unexported fields
}

type FileMappingEntry64 struct {
	Start, End, FileOffset uint64
}

type FileMappingHeader64 struct {
	Entries  uint64
	PageSize uint64
}

type MachineData struct {
	// Machine is the Process Machine type
	Machine elf.Machine
	// CodePACMask contains the PAC mask for code pointers. ARM64 specific, otherwise 0.
	CodePACMask uint64
	// DataPACMask contains the PAC mask for data pointers. ARM64 specific, otherwise 0.
	DataPACMask uint64
}

type Mapping struct {
	// Vaddr is the virtual memory start for this mapping
	Vaddr uint64
	// Length is the length of the mapping
	Length uint64
	// Flags contains the mapping flags and permissions
	Flags elf.ProgFlag
	// FileOffset contains for file backed mappings the offset from the file start
	FileOffset uint64
	// Device holds the device ID where the file is located
	Device uint64
	// Inode holds the mapped file's inode number
	Inode uint64
	// Path contains the file name for file backed mappings
	Path string
}

type Note64 struct {
	Namesz, Descsz, Type uint32
}

type Process interface {
	// PID returns the process identifier
	PID() libpf.PID

	// GetMachineData reads machine specific data from the target process
	GetMachineData() MachineData

	// GetMapping reads and parses process memory mappings
	GetMappings() ([]Mapping, error)

	// GetThread reads the process thread states
	GetThreads() ([]ThreadInfo, error)

	// GetRemoteMemory returns a remote memory reader accessing the target process
	GetRemoteMemory() remotememory.RemoteMemory

	// OpenMappingFile returns ReadAtCloser accessing the backing file of the mapping
	OpenMappingFile(*Mapping) (ReadAtCloser, error)

	// GetMappingFile returns the openable file name for the mapping if available.
	// Empty string is returned if the mapping file is not accessible via filesystem.
	GetMappingFile(*Mapping) string

	// CalculateMappingFileID calculates FileID of the backing file
	CalculateMappingFileID(*Mapping) (libpf.FileID, error)

	io.Closer

	pfelf.ELFOpener
}

type PrpsInfo64 struct {
	State  uint8
	Sname  uint8
	Zombie uint8
	Nice   uint8
	Gap    uint32
	Flags  uint64
	UID    uint32
	GID    uint32
	PID    uint32
	PPID   uint32
	PGRP   uint32
	SID    uint32
	FName  [16]byte
	Args   [80]byte
}

type ReadAtCloser interface {
	io.ReaderAt
	io.Closer
}

type ThreadInfo struct {
	// TPBase contains the Thread Pointer Base value
	TPBase uint64
	// GPRegs contains the CPU state (registers) for the thread
	GPRegs []byte
	// LWP is the Light Weight Process ID (thread ID)
	LWP uint32
}