procinsh 0.1.2

A local, read-only Linux x86-64 process inspector
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

use crate::process::maps::MemoryMap;
use serde::Serialize;

#[derive(Clone, Debug, Serialize)]
pub struct Register {
    pub name: String,
    #[serde(serialize_with = "crate::process::maps::hex")]
    pub value: u64,
    pub decimal: String,
    pub kind: String,
    pub mapping: Option<String>,
    pub offset: Option<String>,
}

pub fn classify(name: &str, value: u64, maps: &[MemoryMap]) -> Register {
    let map = maps.iter().find(|m| m.contains(value));
    Register {
        name: name.into(),
        value,
        decimal: value.to_string(),
        kind: map.map_or("integer", |m| m.kind()).into(),
        mapping: map.map(|m| {
            format!(
                "{} [{}]",
                m.pathname.as_deref().unwrap_or("[anonymous]"),
                m.permissions
            )
        }),
        offset: map.map(|m| format!("0x{:x}", value - m.start)),
    }
}

pub fn from_raw(r: &libc::user_regs_struct, maps: &[MemoryMap]) -> Vec<Register> {
    [
        ("RIP", r.rip),
        ("RSP", r.rsp),
        ("RBP", r.rbp),
        ("RAX", r.rax),
        ("RBX", r.rbx),
        ("RCX", r.rcx),
        ("RDX", r.rdx),
        ("RSI", r.rsi),
        ("RDI", r.rdi),
        ("R8", r.r8),
        ("R9", r.r9),
        ("R10", r.r10),
        ("R11", r.r11),
        ("R12", r.r12),
        ("R13", r.r13),
        ("R14", r.r14),
        ("R15", r.r15),
        ("RFLAGS", r.eflags),
    ]
    .into_iter()
    .map(|(name, value)| classify(name, value, maps))
    .collect()
}