edb
edb copied to clipboard
Context capture add map support
Currently, the context capture feature support a lot of helpers, but not yet the most important onces, the map related calls. This is because most helper calls have a parameter with the max size of the output which we can use to capture the results. Map calls like bpf_map_lookup_elem
, bpf_map_update_elem
and bpf_map_delete_elem
don't include size info for the keys and values because this information is included in the map spec. So to be able to instrument these helpers properly, we need to parse the map specs, track which one is referenced by the current helper function and use the appropriate sizes when copying the arguments or return data.