Documentation
¶
Overview ¶
The core library is used to process ELF core dump files. You can open a core dump file and read from addresses in the process that dumped core, called the "inferior". Some ancillary information about the inferior is also provided, like architecture and OS thread state.
There's nothing Go-specific about this library, it could just as easily be used to read a C++ core dump. See ../gocore for the next layer up, a Go-specific core dump reader.
The Read* operations all panic with an error (the builtin Go type) if the inferior is not readable at the address requested.
Index ¶
- type Address
- type Mapping
- type Perm
- type Process
- func (p *Process) Arch() string
- func (p *Process) Args() string
- func (p *Process) ByteOrder() binary.ByteOrder
- func (p *Process) DWARF() (*dwarf.Data, error)
- func (p *Process) LogPtrSize() uint
- func (p *Process) Mappings() []*Mapping
- func (p *Process) PtrSize() int64
- func (p *Process) ReadAt(b []byte, a Address)
- func (p *Process) ReadCString(a Address) string
- func (p *Process) ReadInt(a Address) int64
- func (p *Process) ReadInt16(a Address) int16
- func (p *Process) ReadInt32(a Address) int32
- func (p *Process) ReadInt64(a Address) int64
- func (p *Process) ReadInt8(a Address) int8
- func (p *Process) ReadPtr(a Address) Address
- func (p *Process) ReadUint16(a Address) uint16
- func (p *Process) ReadUint32(a Address) uint32
- func (p *Process) ReadUint64(a Address) uint64
- func (p *Process) ReadUint8(a Address) uint8
- func (p *Process) ReadUintptr(a Address) uint64
- func (p *Process) Readable(a Address) bool
- func (p *Process) ReadableN(a Address, n int64) bool
- func (p *Process) StaticBase() uint64
- func (p *Process) Symbols() (map[string]Address, error)
- func (p *Process) Threads() []*Thread
- func (p *Process) Warnings() []string
- func (p *Process) Writeable(a Address) bool
- type Thread
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Address ¶
type Address uint64
An Address is a location in the inferior's address space.
type Mapping ¶
type Mapping struct {
// contains filtered or unexported fields
}
A Mapping represents a contiguous subset of the inferior's address space.
func (*Mapping) CopyOnWrite ¶
CopyOnWrite reports whether the mapping is a copy-on-write region, i.e. it started as a mapped file and is now writeable. TODO: is this distinguishable from a write-back region?
func (*Mapping) OrigSource ¶
For CopyOnWrite mappings, OrigSource returns the file/offset of the original copy of the data, or "", 0 if none.
type Process ¶
type Process struct {
// contains filtered or unexported fields
}
A Process represents the state of the process that core dumped.
func Core ¶
Core takes the path to a core file and returns a Process that represents the state of the inferior that generated the core file.
base is the base directory from which files in the core can be found.
exePath is the path of the main executable. If "", the path will be determined from the core itself.
func (*Process) LogPtrSize ¶
func (*Process) ReadAt ¶
ReadAt reads len(b) bytes at address a in the inferior and stores them in b.
func (*Process) ReadCString ¶
ReadCString reads a null-terminated string starting at address a.
func (*Process) ReadInt ¶
ReadInt returns an int (of pointer size) read from address a of the inferior.
func (*Process) ReadUint16 ¶
ReadUint16 returns a uint16 read from address a of the inferior.
func (*Process) ReadUint32 ¶
ReadUint32 returns a uint32 read from address a of the inferior.
func (*Process) ReadUint64 ¶
ReadUint64 returns a uint64 read from address a of the inferior.
func (*Process) ReadUintptr ¶
ReadUintptr returns a uint of pointer size read from address a of the inferior.
func (*Process) ReadableN ¶
ReadableN reports whether the n bytes starting at address a are readable.
func (*Process) StaticBase ¶
StaticBase returns the offset at which the main executable was loaded in memory. For example, it should be used when dereferencing DWARF locations.
func (*Process) Symbols ¶
Symbols returns a mapping from name to inferior address, along with any error encountered during reading the symbol information. (There may be both an error and some returned symbols.) Symbols might not be available with core files from stripped binaries.
type Thread ¶
type Thread struct {
// contains filtered or unexported fields
}
A Thread represents an operating system thread.
Source Files