-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathtrace_linux_386.go
59 lines (49 loc) · 1.19 KB
/
trace_linux_386.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
package libtrace
import (
"log"
"syscall"
)
type SyscallId int32
type ReturnCode int32
type regParam int32
func getParam(regs syscall.PtraceRegs, i int) regParam {
switch i {
case 0:
return regParam(regs.Ebx)
case 1:
return regParam(regs.Ecx)
case 2:
return regParam(regs.Edx)
case 3:
return regParam(regs.Esi)
case 4:
return regParam(regs.Edi)
case 5:
return regParam(regs.Ebp)
}
log.Fatalf("index out of range: %d", i)
return 0
}
func getReturnCode(regs syscall.PtraceRegs) ReturnCode {
return ReturnCode(regs.Eax)
}
func getSyscallId(regs syscall.PtraceRegs) (SyscallId, int) {
if regs.Orig_eax == 102 /*socketcall*/ {
return SyscallId(regs.Ebx + 400), 1
} else if regs.Orig_eax == 117 /* ipc */ {
return SyscallId(regs.Ebx + 420), 1
} else {
return SyscallId(regs.Orig_eax), 0
}
}
func (t *tracerImpl) callback(regs syscall.PtraceRegs, exit bool) {
// params: %ebx, %ecx, %edx, %esi, %edi, %ebp
t.callback_generic(regs, exit)
}
func (t *tracerImpl) customDecodeArgs(trace *Trace, regs syscall.PtraceRegs) bool {
return true
}
var decodeReturnCodeFnMap = map[SyscallId]decodeReturnCodeFn{
3 /*open*/ : decodeReturnCodeLinux,
5 /*open*/ : decodeReturnCodeLinux,
}