callstackMapValuer returns map valuer with thread stack frame data.
(segments []*BoundSegmentLiteral, frame callstack.Frame, proc windows.Handle)
| 548 | |
| 549 | // callstackMapValuer returns map valuer with thread stack frame data. |
| 550 | func (f *Foreach) callstackMapValuer(segments []*BoundSegmentLiteral, frame callstack.Frame, proc windows.Handle) MapValuer { |
| 551 | var valuer = MapValuer{} |
| 552 | for _, seg := range segments { |
| 553 | key := seg.Value |
| 554 | switch seg.Segment { |
| 555 | case fields.AddressSegment: |
| 556 | valuer[key] = frame.Addr.String() |
| 557 | case fields.OffsetSegment: |
| 558 | valuer[key] = frame.Offset |
| 559 | case fields.IsUnbackedSegment: |
| 560 | valuer[key] = frame.IsUnbacked() |
| 561 | case fields.ModuleSegment: |
| 562 | valuer[key] = frame.Module |
| 563 | case fields.SymbolSegment: |
| 564 | valuer[key] = frame.Module + "!" + frame.Symbol |
| 565 | case fields.AllocationSizeSegment: |
| 566 | valuer[key] = frame.AllocationSize(proc) |
| 567 | case fields.ProtectionSegment: |
| 568 | valuer[key] = frame.Protection(proc) |
| 569 | case fields.CallsiteTrailingAssemblySegment: |
| 570 | valuer[key] = frame.CallsiteAssembly(proc, false) |
| 571 | case fields.CallsiteLeadingAssemblySegment: |
| 572 | valuer[key] = frame.CallsiteAssembly(proc, true) |
| 573 | case fields.ModuleSignatureExistsSegment, fields.ModuleSignatureTrustedSegment, |
| 574 | fields.ModuleSignatureIssuerSegment, fields.ModuleSignatureSubjectSegment: |
| 575 | |
| 576 | if frame.ModuleAddress.IsZero() { |
| 577 | continue |
| 578 | } |
| 579 | |
| 580 | segment := seg.Segment |
| 581 | sign := signature.GetSignatures().GetSignature(frame.ModuleAddress.Uint64()) |
| 582 | if sign == nil && frame.Module != "" { |
| 583 | // register signature if not present in the cache |
| 584 | var err error |
| 585 | sign = &signature.Signature{Filename: frame.Module} |
| 586 | sign.Type, sign.Level, err = sign.Check() |
| 587 | if err != nil { |
| 588 | continue |
| 589 | } |
| 590 | |
| 591 | if sign.IsSigned() { |
| 592 | sign.Verify() |
| 593 | } |
| 594 | |
| 595 | if segment == fields.ModuleSignatureIssuerSegment || segment == fields.ModuleSignatureSubjectSegment { |
| 596 | if err := sign.ParseCertificate(); err != nil { |
| 597 | continue |
| 598 | } |
| 599 | } |
| 600 | |
| 601 | signature.GetSignatures().PutSignature(frame.ModuleAddress.Uint64(), sign) |
| 602 | } |
| 603 | |
| 604 | switch segment { |
| 605 | case fields.ModuleSignatureExistsSegment: |
| 606 | valuer[key] = sign.IsSigned() |
| 607 | case fields.ModuleSignatureTrustedSegment: |
no test coverage detected