elfcore 2.0.2

elfcore is a crate to create ELF core dumps for processes on Linux.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.

//! Process trace helpers, not machine-specific ones.

use std::ffi::c_void;
use std::ptr;

use crate::elf::NT_PRFPREG;
use crate::elf::NT_PRSTATUS;
use crate::CoreError;
use nix::sys::ptrace::Request;
use nix::sys::ptrace::RequestType;
use nix::unistd::Pid;
use zerocopy::FromBytes;
use zerocopy::IntoBytes;

pub fn ptrace_get_reg_set<T: IntoBytes + FromBytes>(
    pid: Pid,
    set: u32,
) -> Result<Vec<T>, CoreError> {
    let mut data = Vec::with_capacity(0x1000 / size_of::<T>());
    let vec = libc::iovec {
        iov_base: data.as_mut_ptr() as *mut c_void,
        iov_len: data.capacity() * size_of::<T>(),
    };
    let err;

    // SAFETY: Using FFI with the process trace API to read raw bytes.
    unsafe {
        err = libc::ptrace(
            Request::PTRACE_GETREGSET as RequestType,
            libc::pid_t::from(pid),
            set,
            &vec as *const _ as *const c_void,
        );

        data.set_len(vec.iov_len / size_of::<T>());
        data.shrink_to_fit();
    };

    nix::errno::Errno::result(err)?;
    Ok(data)
}

pub fn ptrace_interrupt(pid: Pid) -> Result<(), CoreError> {
    // SAFETY: Using FFI with the process trace API to read raw bytes.
    let ret = unsafe {
        nix::errno::Errno::clear();
        libc::ptrace(
            libc::PTRACE_INTERRUPT as RequestType,
            libc::pid_t::from(pid),
            ptr::null_mut::<c_void>(),
            ptr::null_mut::<c_void>(),
        )
    };
    match nix::errno::Errno::result(ret) {
        Ok(..) => Ok(()),
        Err(e) => Err(CoreError::NixError(e)),
    }
}

pub fn get_gp_reg_set(pid: Pid) -> Result<Vec<u64>, CoreError> {
    ptrace_get_reg_set(pid, NT_PRSTATUS)
}

pub fn get_fp_reg_set(pid: Pid) -> Result<Vec<u8>, CoreError> {
    ptrace_get_reg_set(pid, NT_PRFPREG)
}