Struct Registers 

pub struct Registers { /* private fields */ }

Helpers for reading and writing register state of the traced process.

Registers stores a snapshot of the platform user_regs_struct for a given Pid and provides convenience accessors. Currently this module assumes x86_64 register layout.

Implementations

impl Registers

pub fn read(pid: Pid) -> Result<Self>

Read the current register state for pid.

Arguments

• pid - The process id of the traced process to read registers from.

Errors

Returns an error if the underlying ptrace::getregs call fails.

Returns

A Result containing the Registers snapshot on success.

pub fn write(&self) -> Result<()>

Write the locally-modified register state back to the tracee.

Errors

Returns an error if ptrace::setregs fails.

Returns

Returns Ok(()) on success.

pub fn rip(&self) -> u64

Instruction pointer (RIP).

Returns

The current value of the instruction pointer (RIP) for the stored register snapshot.

pub fn set_rip(&mut self, value: u64)

Set the instruction pointer.

Arguments

• value - The new instruction pointer (RIP) value to store in the snapshot.

pub fn rsp(&self) -> u64

Stack pointer (RSP).

Returns

The current value of the stack pointer (RSP).

pub fn rax(&self) -> u64

Return the RAX register value.

Returns

The value of the rax register in the snapshot.

pub fn orig_rax(&self) -> u64

Return the original RAX value saved by the kernel (useful for syscalls).

Returns

The orig_rax register value recorded by the kernel.

pub fn function_params(&self) -> [u64; 6]

Return the 6 register parameters passed in registers for x86_64 (rdi, rsi, rdx, r10, r8, r9).

Returns

An array with the six parameter registers as u64 in calling convention order.

Trait Implementations

impl Display for Registers

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.