-
Notifications
You must be signed in to change notification settings - Fork 78
/
offsets.go
49 lines (40 loc) · 1.26 KB
/
offsets.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
// Package goexec helps analyzing Go executables
package goexec
import (
"fmt"
"github.com/grafana/beyla/pkg/internal/exec"
)
type Offsets struct {
// Funcs key: function name
Funcs map[string]FuncOffsets
Field FieldOffsets
}
type FuncOffsets struct {
Start uint64
Returns []uint64
}
type FieldOffsets map[string]any
// InspectOffsets gets the memory addresses/offsets of the instrumenting function, as well as the required
// parameters fields to be read from the eBPF code
func InspectOffsets(execElf *exec.FileInfo, funcs []string) (*Offsets, error) {
if execElf == nil {
return nil, fmt.Errorf("executable not found")
}
// Analyse executable ELF file and find instrumentation points
found, err := instrumentationPoints(execElf.ELF, funcs)
if err != nil {
return nil, fmt.Errorf("finding instrumentation points: %w", err)
}
if len(found) == 0 {
return nil, fmt.Errorf("couldn't find any instrumentation point in %s", execElf.CmdExePath)
}
// check the offsets of the required fields from the method arguments
structFieldOffsets, err := structMemberOffsets(execElf.ELF)
if err != nil {
return nil, fmt.Errorf("checking struct members in file %s: %w", execElf.ProExeLinkPath, err)
}
return &Offsets{
Funcs: found,
Field: structFieldOffsets,
}, nil
}