elfcore

package
v0.0.0-...-eace9c9 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 15, 2025 License: BSD-3-Clause Imports: 9 Imported by: 0

Documentation

Index

Constants

View Source
const (
	ElfClass64  = 2
	ElfData2LSB = 1
	ElfVersion  = 1
	ET_CORE     = 4
	PT_NOTE     = 4
	PT_LOAD     = 1
)

ELF constants

Variables

This section is empty.

Functions

func GetELFMachine

func GetELFMachine() uint16

GetELFMachine returns the ELF machine type for the current architecture.

Types

type CoreInfo

type CoreInfo struct {
	Pid     int
	Threads []Thread
	VMAs    []VMA
	Notes   []Note
	// File table for NT_FILE note
	FileTable []FileEntry
}

CoreInfo contains all information needed to generate a core file.

type ELFWriter

type ELFWriter struct {
	// contains filtered or unexported fields
}

ELFWriter handles writing ELF core files

func NewELFWriter

func NewELFWriter(filename string, info *CoreInfo, bufferManager *buffer.Manager) (*ELFWriter, error)

NewELFWriter creates a new ELF core file writer

func (*ELFWriter) Close

func (w *ELFWriter) Close() error

Close closes the ELF writer

func (*ELFWriter) WriteCore

func (w *ELFWriter) WriteCore() error

WriteCore writes the complete ELF core file

type FileEntry

type FileEntry struct {
	Start   uintptr
	End     uintptr
	FileOfs uint64
	Dev     uint64
	Inode   uint64
	Path    string
}

FileEntry represents a file in the NT_FILE note.

type LoadSegment

type LoadSegment struct {
	VMA    VMA
	Offset uint64
}

LoadSegment represents a PT_LOAD segment

type Note

type Note struct {
	Name string
	Type NoteType
	Data []byte
}

Note represents an ELF note.

func CreateCoreNotes

func CreateCoreNotes(pid int, threads []Thread, fileTable []FileEntry) ([]Note, error)

CreateCoreNotes creates all the notes for a core file

type NoteType

type NoteType uint32

NoteType represents ELF note types.

const (
	NT_PRSTATUS NoteType = 1
	NT_FPREGSET NoteType = 2
	NT_PRPSINFO NoteType = 3
	NT_AUXV     NoteType = 6
	NT_XSTATE   NoteType = 0x202
	NT_SIGINFO  NoteType = 0x53494749
	NT_FILE     NoteType = 0x46494c45
)

type NoteWriter

type NoteWriter struct {
	// contains filtered or unexported fields
}

NoteWriter handles writing ELF notes

func NewNoteWriter

func NewNoteWriter() *NoteWriter

NewNoteWriter creates a new note writer

func (*NoteWriter) Bytes

func (nw *NoteWriter) Bytes() []byte

Bytes returns the written notes as bytes

func (*NoteWriter) Size

func (nw *NoteWriter) Size() int

Size returns the total size of written notes

func (*NoteWriter) WriteNote

func (nw *NoteWriter) WriteNote(name string, noteType NoteType, data []byte) error

WriteNote writes a note to the buffer

type Perm

type Perm uint8

Perm represents memory permissions.

const (
	PermRead  Perm = 1 << 0
	PermWrite Perm = 1 << 1
	PermExec  Perm = 1 << 2
)

type Thread

type Thread struct {
	Tid       int
	Registers []byte // Raw register data
}

Thread represents a thread in the target process.

type VMA

type VMA struct {
	Start   uintptr
	End     uintptr
	Perms   Perm
	Offset  uint64
	Dev     uint64
	Inode   uint64
	Path    string
	Kind    VMAKind
	VmFlags []VMFlag // Memory advice flags from smaps
	IsZero  bool     // True if this VMA should be zero-filled (no permissions)
	// Internal fields for tracking
	FileOffset uint64 // Offset in core file
	MemSize    uint64 // Size in core file
}

VMA represents a virtual memory area.

func (*VMA) IsDumpable

func (vma *VMA) IsDumpable() bool

IsDumpable returns true if the VMA should be included in the core dump.

func (*VMA) Size

func (vma *VMA) Size() uint64

Size returns the size of the VMA.

type VMAKind

type VMAKind int

VMAKind represents the type of memory mapping.

const (
	VMAAnonymous VMAKind = 0
	VMAFile      VMAKind = 1
	VMAHeap      VMAKind = 2
	VMAStack     VMAKind = 3
	VMAShared    VMAKind = 4
)

type VMFlag

type VMFlag [2]byte

VMFlag represents a single memory advice flag (2 characters).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL