debug: Index | Files

package core

import ""

The core library is used to process ELF core dump files. You can open a core dump file and read from addresses in the process that dumped core, called the "inferior". Some ancillary information about the inferior is also provided, like architecture and OS thread state.

There's nothing Go-specific about this library, it could just as easily be used to read a C++ core dump. See ../gocore for the next layer up, a Go-specific core dump reader.

The Read* operations all panic with an error (the builtin Go type) if the inferior is not readable at the address requested.


Package Files

address.go mapping.go process.go process_unix.go read.go thread.go

type Address Uses

type Address uint64

An Address is a location in the inferior's address space.

func (Address) Add Uses

func (a Address) Add(x int64) Address

Add adds x to address a.

func (Address) Align Uses

func (a Address) Align(x int64) Address

Align rounds a up to a multiple of x. x must be a power of 2.

func (Address) Max Uses

func (a Address) Max(b Address) Address

Max returns the larger of a and b.

func (Address) Min Uses

func (a Address) Min(b Address) Address

Min returns the smaller of a and b.

func (Address) Sub Uses

func (a Address) Sub(b Address) int64

Sub subtracts b from a. Requires a >= b.

type Mapping Uses

type Mapping struct {
    // contains filtered or unexported fields

A Mapping represents a contiguous subset of the inferior's address space.

func (*Mapping) CopyOnWrite Uses

func (m *Mapping) CopyOnWrite() bool

CopyOnWrite reports whether the mapping is a copy-on-write region, i.e. it started as a mapped file and is now writeable. TODO: is this distinguishable from a write-back region?

func (*Mapping) Max Uses

func (m *Mapping) Max() Address

Max returns the virtual address of the byte just beyond the mapping.

func (*Mapping) Min Uses

func (m *Mapping) Min() Address

Min returns the lowest virtual address of the mapping.

func (*Mapping) OrigSource Uses

func (m *Mapping) OrigSource() (string, int64)

For CopyOnWrite mappings, OrigSource returns the file/offset of the original copy of the data, or "", 0 if none.

func (*Mapping) Perm Uses

func (m *Mapping) Perm() Perm

Perm returns the permissions on the mapping.

func (*Mapping) Size Uses

func (m *Mapping) Size() int64

Size returns int64(Max-Min)

func (*Mapping) Source Uses

func (m *Mapping) Source() (string, int64)

Source returns the backing file and offset for the mapping, or "", 0 if none.

type Perm Uses

type Perm uint8

A Perm represents the permissions allowed for a Mapping.

const (
    Read Perm = 1 << iota

func (Perm) String Uses

func (p Perm) String() string

type Process Uses

type Process struct {
    // contains filtered or unexported fields

A Process represents the state of the process that core dumped.

func Core Uses

func Core(coreFile, base, exePath string) (*Process, error)

Core takes the name of a core file and returns a Process that represents the state of the inferior that generated the core file.

func (*Process) Arch Uses

func (p *Process) Arch() string

func (*Process) Args Uses

func (p *Process) Args() string

Args returns the initial part of the program arguments.

func (*Process) ByteOrder Uses

func (p *Process) ByteOrder() binary.ByteOrder

func (*Process) DWARF Uses

func (p *Process) DWARF() (*dwarf.Data, error)

func (*Process) LogPtrSize Uses

func (p *Process) LogPtrSize() uint

func (*Process) Mappings Uses

func (p *Process) Mappings() []*Mapping

Mappings returns a list of virtual memory mappings for p.

func (*Process) PtrSize Uses

func (p *Process) PtrSize() int64

PtrSize returns the size in bytes of a pointer in the inferior.

func (*Process) ReadAt Uses

func (p *Process) ReadAt(b []byte, a Address)

ReadAt reads len(b) bytes at address a in the inferior and stores them in b.

func (*Process) ReadCString Uses

func (p *Process) ReadCString(a Address) string

ReadCString reads a null-terminated string starting at address a.

func (*Process) ReadInt Uses

func (p *Process) ReadInt(a Address) int64

ReadInt returns an int (of pointer size) read from address a of the inferior.

func (*Process) ReadInt16 Uses

func (p *Process) ReadInt16(a Address) int16

ReadInt16 returns an int16 read from address a of the inferior.

func (*Process) ReadInt32 Uses

func (p *Process) ReadInt32(a Address) int32

ReadInt32 returns an int32 read from address a of the inferior.

func (*Process) ReadInt64 Uses

func (p *Process) ReadInt64(a Address) int64

ReadInt64 returns an int64 read from address a of the inferior.

func (*Process) ReadInt8 Uses

func (p *Process) ReadInt8(a Address) int8

ReadInt8 returns an int8 read from address a of the inferior.

func (*Process) ReadPtr Uses

func (p *Process) ReadPtr(a Address) Address

ReadPtr returns a pointer loaded from address a of the inferior.

func (*Process) ReadUint16 Uses

func (p *Process) ReadUint16(a Address) uint16

ReadUint16 returns a uint16 read from address a of the inferior.

func (*Process) ReadUint32 Uses

func (p *Process) ReadUint32(a Address) uint32

ReadUint32 returns a uint32 read from address a of the inferior.

func (*Process) ReadUint64 Uses

func (p *Process) ReadUint64(a Address) uint64

ReadUint64 returns a uint64 read from address a of the inferior.

func (*Process) ReadUint8 Uses

func (p *Process) ReadUint8(a Address) uint8

ReadUint8 returns a uint8 read from address a of the inferior.

func (*Process) ReadUintptr Uses

func (p *Process) ReadUintptr(a Address) uint64

ReadUintptr returns a uint of pointer size read from address a of the inferior.

func (*Process) Readable Uses

func (p *Process) Readable(a Address) bool

Readable reports whether the address a is readable.

func (*Process) ReadableN Uses

func (p *Process) ReadableN(a Address, n int64) bool

ReadableN reports whether the n bytes starting at address a are readable.

func (*Process) Symbols Uses

func (p *Process) Symbols() (map[string]Address, error)

Symbols returns a mapping from name to inferior address, along with any error encountered during reading the symbol information. (There may be both an error and some returned symbols.) Symbols might not be available with core files from stripped binaries.

func (*Process) Threads Uses

func (p *Process) Threads() []*Thread

Threads returns information about each OS thread in the inferior.

func (*Process) Warnings Uses

func (p *Process) Warnings() []string

func (*Process) Writeable Uses

func (p *Process) Writeable(a Address) bool

Writeable reports whether the address a was writeable (by the inferior at the time of the core dump).

type Thread Uses

type Thread struct {
    // contains filtered or unexported fields

A Thread represents an operating system thread.

func (*Thread) PC Uses

func (t *Thread) PC() Address

func (*Thread) Pid Uses

func (t *Thread) Pid() uint64

func (*Thread) Regs Uses

func (t *Thread) Regs() []uint64

Regs returns the set of register values for the thread. What registers go where is architecture-dependent. TODO: document for each architecture. TODO: do this in some arch-independent way?

func (*Thread) SP Uses

func (t *Thread) SP() Address

Package core imports 11 packages (graph) and is imported by 3 packages. Updated 2019-11-15. Refresh now. Tools for package owners.