Module maps 

Structs

ProcModuleKey

Key for proc_module_offsets map: { pid:u32, pad:u32, cookie_lo:u32, cookie_hi:u32 }

ProcModuleOffsetsValue

Value for proc_module_offsets map - section offsets for a module

Constants

ALLOWED_PIDS_MAP_NAME

PROC_OFFSETS_MAP_NAME

Map name as embedded in BPF object

Functions

allowed_pids_pin_path

Compute the bpffs pin path for the allowed_pids map for current process

cleanup_pinned_proc_offsets

Remove the pinned proc_module_offsets map and its per-process directory (best effort). Safe to call multiple times; missing paths are ignored.

ensure_pinned_allowed_pids_exists

Ensure the pinned allowed_pids map exists under the per-process directory.

ensure_pinned_proc_offsets_exists

Ensure the pinned global proc_module_offsets map exists at the standard path. If not present, create and pin it with the specified capacity.

insert_allowed_pid

Insert a PID into the allowed_pids pinned map.

insert_offsets_for_pid

Open the pinned global proc_module_offsets map and insert entries via raw bpf syscall.

proc_offsets_pin_dir

Pin directory containing the per-process offsets map

proc_offsets_pin_path

Compute the bpffs pin path for the proc_module_offsets map for current process Using per-process directory avoids conflicts across multiple GhostScope instances

purge_offsets_for_pid

Purge all entries for a given pid in the pinned proc_module_offsets map.

remove_allowed_pid

Remove a PID from the allowed_pids pinned map.