Documentation
¶
Overview ¶
This package contains functions and data structures used by both the linux implementation of the native backend and the core backend to deal with structures used by the linux kernel.
Index ¶
- Variables
- func AMD64XstateRead(xstateargs []byte, readLegacy bool, regset *AMD64Xstate) error
- func ElfUpdateSharedObjects(p proc.Process) error
- func EntryPointFromAuxvAMD64(auxv []byte) uint64
- type AMD64PtraceFpRegs
- type AMD64PtraceRegs
- type AMD64Registers
- func (r *AMD64Registers) BP() uint64
- func (r *AMD64Registers) CX() uint64
- func (r *AMD64Registers) Copy() proc.Registers
- func (r *AMD64Registers) GAddr() (uint64, bool)
- func (r *AMD64Registers) Get(n int) (uint64, error)
- func (r *AMD64Registers) PC() uint64
- func (r *AMD64Registers) SP() uint64
- func (r *AMD64Registers) Slice(floatingPoint bool) []proc.Register
- func (r *AMD64Registers) TLS() uint64
- type AMD64Xstate
Constants ¶
This section is empty.
Variables ¶
var ErrTooManyLibraries = errors.New("number of loaded libraries exceeds maximum")
Functions ¶
func AMD64XstateRead ¶
func AMD64XstateRead(xstateargs []byte, readLegacy bool, regset *AMD64Xstate) error
LinuxX86XstateRead reads a byte array containing an XSAVE area into regset. If readLegacy is true regset.PtraceFpRegs will be filled with the contents of the legacy region of the XSAVE area. See Section 13.1 (and following) of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture.
func ElfUpdateSharedObjects ¶ added in v1.3.0
ElfUpdateSharedObjects reads the list of dynamic libraries loaded by the dynamic linker from the .dynamic section and uses it to update p.BinInfo(). See the SysV ABI for a description of how the .dynamic section works: http://www.sco.com/developers/gabi/latest/contents.html
func EntryPointFromAuxvAMD64 ¶
EntryPointFromAuxv searches the elf auxiliary vector for the entry point address. For a description of the auxiliary vector (auxv) format see: System V Application Binary Interface, AMD64 Architecture Processor Supplement, section 3.4.3
Types ¶
type AMD64PtraceFpRegs ¶
type AMD64PtraceFpRegs struct {
Cwd uint16
Swd uint16
Ftw uint16
Fop uint16
Rip uint64
Rdp uint64
Mxcsr uint32
MxcrMask uint32
StSpace [32]uint32
XmmSpace [256]byte
Padding [24]uint32
}
AMD64PtraceFpRegs tracks user_fpregs_struct in /usr/include/x86_64-linux-gnu/sys/user.h
type AMD64PtraceRegs ¶
type AMD64PtraceRegs struct {
R15 uint64
R14 uint64
R13 uint64
R12 uint64
Rbp uint64
Rbx uint64
R11 uint64
R10 uint64
R9 uint64
R8 uint64
Rax uint64
Rcx uint64
Rdx uint64
Rsi uint64
Rdi uint64
Orig_rax uint64
Rip uint64
Cs uint64
Eflags uint64
Rsp uint64
Ss uint64
Fs_base uint64
Gs_base uint64
Ds uint64
Es uint64
Fs uint64
Gs uint64
}
AMD64PtraceRegs is the struct used by the linux kernel to return the general purpose registers for AMD64 CPUs.
type AMD64Registers ¶
type AMD64Registers struct {
Regs *AMD64PtraceRegs
Fpregs []proc.Register
Fpregset *AMD64Xstate
}
AMD64Registers implements the proc.Registers interface for the native/linux backend and core/linux backends, on AMD64.
func (*AMD64Registers) BP ¶
func (r *AMD64Registers) BP() uint64
func (*AMD64Registers) CX ¶
func (r *AMD64Registers) CX() uint64
CX returns the value of RCX register.
func (*AMD64Registers) Copy ¶
func (r *AMD64Registers) Copy() proc.Registers
Copy returns a copy of these registers that is guarenteed not to change.
func (*AMD64Registers) GAddr ¶
func (r *AMD64Registers) GAddr() (uint64, bool)
GAddr returns the address of the G variable if it is known, 0 and false otherwise.
func (*AMD64Registers) Get ¶
func (r *AMD64Registers) Get(n int) (uint64, error)
Get returns the value of the n-th register (in x86asm order).
func (*AMD64Registers) PC ¶
func (r *AMD64Registers) PC() uint64
PC returns the value of RIP register.
func (*AMD64Registers) SP ¶
func (r *AMD64Registers) SP() uint64
SP returns the value of RSP register.
func (*AMD64Registers) Slice ¶
func (r *AMD64Registers) Slice(floatingPoint bool) []proc.Register
Slice returns the registers as a list of (name, value) pairs.
func (*AMD64Registers) TLS ¶
func (r *AMD64Registers) TLS() uint64
TLS returns the address of the thread local storage memory segment.
type AMD64Xstate ¶
type AMD64Xstate struct {
AMD64PtraceFpRegs
Xsave []byte // raw xsave area
AvxState bool // contains AVX state
YmmSpace [256]byte
}
AMD64Xstate represents amd64 XSAVE area. See Section 13.1 (and following) of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture.
func (*AMD64Xstate) Decode ¶
func (xsave *AMD64Xstate) Decode() (regs []proc.Register)
Decode decodes an XSAVE area to a list of name/value pairs of registers.
Source Files