Expand description
Loaded-module inventory and in-memory PE section lookup (#635).
Unwinding a captured stack needs, for every loaded module, its image base
and the address ranges of specific sections — on Windows, .pdata and
.xdata carry the unwind tables. This module supplies that inventory.
§Why parse the mapped image rather than the file
The module is already mapped into this process, so its headers are directly readable and no file I/O is needed. That matters because this inventory is built to interpret captures taken while threads were suspended: touching the filesystem here would make the capture path depend on disk availability, and a module can be deleted or replaced on disk while still mapped.
§What this deliberately does not do
No unwinding, and no symbolization. This is the address bookkeeping an unwinder consumes, split out so it can be verified on its own — the ranges it reports are checkable against known function addresses without any unwinder existing yet.
Structs§
- Loaded
Module - A module loaded in this process.
- Section
- One section of a mapped module.
Functions§
- enumerate_
modules - Enumerate ELF images mapped in the current Linux process.
- module_
for_ address - Find the module containing
address.