Module: SeccompTools::Disasm

Defined in:
lib/seccomp-tools/disasm/disasm.rb,
lib/seccomp-tools/disasm/context.rb

Overview

Disassembler of seccomp bpf.

Defined Under Namespace

Classes: Context

Class Method Summary collapse

Class Method Details

.disasm(raw, arch: nil) ⇒ Object

Disassemble bpf codes.



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
 
# File 'lib/seccomp-tools/disasm/disasm.rb', line 19

def disasm(raw, arch: nil)
  codes = to_bpf(raw, arch)
  contexts = Array.new(codes.size) { Set.new }
  contexts[0].add(Context.new)
  # all we care is if A is exactly one of data[*]
  dis = codes.zip(contexts).map do |code, ctxs|
    ctxs.each do |ctx|
      code.branch(ctx) do |pc, c|
        contexts[pc].add(c) unless pc >= contexts.size
      end
    end
    code.contexts = ctxs
    code.disasm
  end.join("\n")
  <<-EOS
 line  CODE  JT   JF      K
=================================
#{dis}
  EOS
end

.to_bpf(raw, arch) ⇒ Array<BPF>

Convert raw bpf string to array of BPF.



44
45
46
47
 
# File 'lib/seccomp-tools/disasm/disasm.rb', line 44

def to_bpf(raw, arch)
  arch ||= Util.system_arch
  raw.scan(/.{8}/m).map.with_index { |b, i| BPF.new(b, arch, i) }
end