stracers-core 0.1.0

/// Represents a single syscall that has been observed (after both entry and exit).
pub struct SyscallEvent {
    pub pid: i32,
    pub number: u64,
    pub name: Option<&'static str>,
    pub args: [u64; 6],
    pub ret: Option<i64>,
    pub decoded_args: Vec<DecodedArg>,
}

/// A pretty-printed syscall argument.
pub enum DecodedArg {
    /// Raw hex value (fallback when no decoding is available).
    Raw(u64),
    /// File descriptor, e.g. `3` or a symbolic name like `AT_FDCWD`.
    Fd(i32),
    /// Null-terminated path string read from tracee memory.
    Path(String),
    /// Bitwise OR of named flags, e.g. `O_RDONLY|O_CLOEXEC`.
    Flags(String),
    /// A buffer shown as a quoted byte string (truncated).
    Buf(Vec<u8>, usize),
    /// An opaque pointer/address, displayed as hex.
    Addr(u64),
    /// A plain integer (signed).
    Int(i64),
    /// An unsigned size value.
    Size(u64),
}

impl std::fmt::Display for DecodedArg {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            DecodedArg::Raw(v) => write!(f, "{:#x}", v),
            DecodedArg::Fd(fd) => {
                match *fd {
                    -100 => write!(f, "AT_FDCWD"),
                    _ => write!(f, "{}", fd),
                }
            }
            DecodedArg::Path(s) => write!(f, "\"{}\"", s),
            DecodedArg::Flags(s) => write!(f, "{}", s),
            DecodedArg::Buf(bytes, total_len) => {
                write!(f, "\"")?;
                for &b in bytes.iter().take(32) {
                    match b {
                        b'\n' => write!(f, "\\n")?,
                        b'\r' => write!(f, "\\r")?,
                        b'\t' => write!(f, "\\t")?,
                        b'\\' => write!(f, "\\\\")?,
                        b'"' => write!(f, "\\\"")?,
                        0x20..=0x7e => write!(f, "{}", b as char)?,
                        _ => write!(f, "\\x{:02x}", b)?,
                    }
                }
                write!(f, "\"")?;
                if *total_len > 32 {
                    write!(f, "...({} bytes)", total_len)?;
                }
                Ok(())
            }
            DecodedArg::Addr(v) => {
                if *v == 0 {
                    write!(f, "NULL")
                } else {
                    write!(f, "{:#x}", v)
                }
            }
            DecodedArg::Int(v) => write!(f, "{}", v),
            DecodedArg::Size(v) => write!(f, "{}", v),
        }
    }
}