()
| 37 | } |
| 38 | |
| 39 | func (this *SyscallEvent) ParseContext() (err error) { |
| 40 | this.ReadArg(&this.NR) |
| 41 | |
| 42 | this.nr_point = this.mconf.SysCallConf.GetSyscallPointByNR(this.NR) |
| 43 | // this.nr_point = config.GetSyscallPointByNR(this.NR) |
| 44 | this.PointName = this.nr_point.Name |
| 45 | |
| 46 | // this.logger.Printf("ParseContext EventId:%d RawSample:\n%s", this.EventId, util.HexDump(this.rec.RawSample, util.COLORRED)) |
| 47 | this.PointValue = nil |
| 48 | this.PointStr = "" |
| 49 | if this.EventId == SYSCALL_ENTER { |
| 50 | this.ReadArg(&this.LR) |
| 51 | this.ReadArg(&this.SP) |
| 52 | this.ReadArg(&this.PC) |
| 53 | if this.mconf.FmtJson { |
| 54 | this.PointValue = this.nr_point.ParsePointJson(this.buf, config.EBPF_SYS_ENTER) |
| 55 | } else { |
| 56 | this.PointStr = this.nr_point.ParseEnterPoint(this.buf) |
| 57 | } |
| 58 | } else if this.EventId == SYSCALL_EXIT { |
| 59 | if this.mconf.FmtJson { |
| 60 | this.PointValue = this.nr_point.ParsePointJson(this.buf, config.EBPF_SYS_EXIT) |
| 61 | } else { |
| 62 | this.PointStr = this.nr_point.ParseExitPoint(this.buf) |
| 63 | } |
| 64 | } else { |
| 65 | panic(fmt.Sprintf("SyscallEvent.ParseContext() failed, EventId:%d", this.EventId)) |
| 66 | } |
| 67 | this.ParsePadding() |
| 68 | err = this.ParseContextStack() |
| 69 | if err != nil { |
| 70 | panic(fmt.Sprintf("ParseContextStack err:%v", err)) |
| 71 | } |
| 72 | if this.mconf.AutoResume { |
| 73 | LetItResume(this.Pid) |
| 74 | } |
| 75 | return nil |
| 76 | } |
| 77 | |
| 78 | func (this *SyscallEvent) GetUUID() string { |
| 79 | s := fmt.Sprintf("%d|%d|%s", this.Pid, this.Tid, util.B2STrim(this.Comm[:])) |
no test coverage detected