Struct Mem 

pub struct Mem;

Tracee memory accessor. Cheap to copy; the probe result is global.

Implementations

impl Mem

pub fn read(&self, pid: u32, addr: u64, buf: &mut [u8]) -> Result<usize, i32>

Reads buf.len() bytes at addr in pid’s address space.

Arguments

• pid - Tracee thread id.
• addr - Virtual address in the tracee.
• buf - Destination; a short read returns fewer bytes.

Returns

Bytes read.

Errors

EFAULT for unmapped memory, ESRCH when the tracee is gone.

pub fn write(&self, pid: u32, addr: u64, buf: &[u8]) -> Result<(), i32>

Writes buf at addr in pid’s address space.

Arguments

• pid - Tracee thread id.
• addr - Virtual address in the tracee.
• buf - Bytes to write; a short write is an error.

pub fn write_force(&self, pid: u32, addr: u64, buf: &[u8]) -> Result<(), i32>

Writes buf at addr through /proc/<pid>/mem, whatever the page’s protection.

process_vm_writev honours the mapping’s permissions, so a string in .rodata cannot be changed that way; /proc/<pid>/mem writes behave like a debugger’s and copy the page privately. Used for the in-place argument rewrites of the no-ptrace mode.

Arguments

• pid - Tracee thread id.
• addr - Virtual address in the tracee.
• buf - Bytes to write; a short write is an error.

pub fn read_cstr(&self, pid: u32, addr: u64) -> Result<Vec<u8>, i32>

Reads a NUL-terminated path of at most PATH_MAX - 1 bytes.

Arguments

• pid - Tracee thread id.
• addr - Address of the first byte.

Returns

The bytes before the NUL.

Errors

ENAMETOOLONG when no NUL is found within PATH_MAX, EFAULT otherwise.

pub fn read_string( &self, pid: u32, addr: u64, max: usize, ) -> Result<Vec<u8>, i32>

Reads a NUL-terminated string of fewer than max bytes.

Reads stop at page boundaries so a short string next to an unmapped page does not fault. An argument or environment entry of an exec is read with MAX_ARG_STRLEN, the kernel’s own limit for one such string; a path with PATH_MAX.

Arguments

• pid - Tracee thread id.
• addr - Address of the first byte.
• max - Length at which the read gives up.

Returns

The bytes before the NUL.

Errors

ENAMETOOLONG when no NUL is found within max bytes, EFAULT otherwise.

pub fn read_ptr_array( &self, pid: u32, addr: u64, max: usize, ) -> Result<Vec<u64>, i32>

Reads a NUL-terminated array of 8-byte pointers (argv/envp style).

Arguments

• pid - Tracee thread id.
• addr - Address of the first pointer.
• max - Give up (with E2BIG) after this many entries.

pub fn read_ptr_array_sized( &self, pid: u32, addr: u64, max: usize, width: usize, ) -> Result<Vec<u64>, i32>

Reads a NUL-terminated pointer array whose entries are width bytes (4 or 8).

Arguments

• pid - Tracee thread id.
• addr - Address of the first pointer.
• max - Give up (with E2BIG) after this many entries.
• width - Pointer size of the tracee’s ABI.

fn mode(&self) -> u8

fn demote(&self) -> bool

Switches to /proc/<pid>/mem once; returns false if already there.

Trait Implementations

impl Clone for Mem

fn clone(&self) -> Mem

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Mem

impl Debug for Mem

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Mem

fn default() -> Mem

Returns the “default value” for a type.