Expand description
Attributing captured addresses to their loaded module (#725).
§Why absolute addresses cannot leave the process
A capture yields absolute return addresses, which are only meaningful
inside the process that produced them and only until it exits: the same
build loads at a different base next time. Symbolization therefore consumes
(module, offset) — stable against ASLR, and re-resolvable against the
same binary long afterwards.
This is the conversion, and it has to happen here, in the capturing process, because that is the only place the module bases exist.
§Getting this wrong is worse than not doing it
An address attributed to the wrong module produces an offset that is meaningless in that module — and a later, entirely correct symbol lookup will turn it into a confident, wrong function name. Nothing downstream can detect that. So an address that falls in no known module is reported as unattributed rather than being assigned to the nearest one.
Structs§
- Attributed
Capture - A capture with every address expressed as module + offset.
- Attributed
Frame - One frame, expressed relative to a module.
- Attributed
Module - A module referenced by an attributed capture.
- Attributed
Thread - One thread’s attributed frames.
Functions§
- attribute
- Express every frame in
snapshotrelative to its module.