Chapter 18. String and data retrieving functions Tapset
Functions to retrieve strings and other primitive types from the kernel or a user space programs based on addresses. All strings are of a maximum length given by MAXSTRINGLEN.
Name
function::kernel_string — Retrieves string from kernel memory.
Synopsis
function kernel_string:string(addr:long)
Arguments
addr
The kernel address to retrieve the string from.
General Syntax
kernel_string:string(addr:long)
Description
This function returns the null terminated C string from a given kernel memory address. Reports an error on string copy fault.
Name
function::kernel_string2 — Retrieves string from kernel memory with alternative error string.
Synopsis
function kernel_string2:string(addr:long,err_msg:string)
Arguments
addr
The kernel address to retrieve the string from.
err_msg
The error message to return when data isn't available.
General Syntax
kernel_string2:string(addr:long, err_msg:string)
Description
This function returns the null terminated C string from a given kernel memory address. Reports the given error message on string copy fault.
Name
function::kernel_string_n — Retrieves string of given length from kernel memory.
Synopsis
function kernel_string_n:string(addr:long,n:long)
Arguments
addr
The kernel address to retrieve the string from.
n
The maximum length of the string (if not null terminated).
General Syntax
kernel_string_n:string(addr:long, n:long)
Description
Returns the C string of a maximum given length from a given kernel memory address. Reports an error on string copy fault.
Name
function::kernel_long — Retrieves a long value stored in kernel memory.
Synopsis
function kernel_long:long(addr:long)
Arguments
addr
The kernel address to retrieve the long from.
General Syntax
kernel_long:long(addr:long)
Description
Returns the long value from a given kernel memory address. Reports an error when reading from the given address fails.
Name
function::kernel_int — Retrieves an int value stored in kernel memory.
Synopsis
function kernel_int:long(addr:long)
Arguments
addr
The kernel address to retrieve the int from.
Description
Returns the int value from a given kernel memory address. Reports an error when reading from the given address fails.
Name
function::kernel_short — Retrieves a short value stored in kernel memory.
Synopsis
function kernel_short:long(addr:long)
Arguments
addr
The kernel address to retrieve the short from.
General Syntax
kernel_short:long(addr:long)
Description
Returns the short value from a given kernel memory address. Reports an error when reading from the given address fails.
Name
function::kernel_char — Retrieves a char value stored in kernel memory.
Synopsis
function kernel_char:long(addr:long)
Arguments
addr
The kernel address to retrieve the char from.
General Syntax
kernel_char:long(addr:long)
Description
Returns the char value from a given kernel memory address. Reports an error when reading from the given address fails.
Name
function::kernel_pointer — Retrieves a pointer value stored in kernel memory.
Synopsis
function kernel_pointer:long(addr:long)
Arguments
addr
The kernel address to retrieve the pointer from.
General Syntax
kernel_pointer:long(addr:long)
Description
Returns the pointer value from a given kernel memory address. Reports an error when reading from the given address fails.
Name
function::user_string — Retrieves string from user space.
Synopsis
function user_string:string(addr:long)
Arguments
addr
The user space address to retrieve the string from.
General Syntax
user_string:string(addr:long)
Description
Returns the null terminated C string from a given user space memory address. Reports “<unknown>” on the rare cases when userspace data is not accessible.
Name
function::user_string2 — Retrieves string from user space with alternative error string.
Synopsis
function user_string2:string(addr:long,err_msg:string)
Arguments
addr
The user space address to retrieve the string from.
err_msg
The error message to return when data isn't available.
General Syntax
user_string2:string(addr:long, err_msg:string)
Description
Returns the null terminated C string from a given user space memory address. Reports the given error message on the rare cases when userspace data is not accessible.
Name
function::user_string_warn — Retrieves string from user space.
Synopsis
function user_string_warn:string(addr:long)
Arguments
addr
The user space address to retrieve the string from.
General Syntax
user_string_warn:string(addr:long)
Description
Returns the null terminated C string from a given user space memory address. Reports “<unknown>” on the rare cases when userspace data is not accessible and warns (but does not abort) about the failure.
Name
function::user_string_quoted — Retrieves and quotes string from user space.
Synopsis
function user_string_quoted:string(addr:long)
Arguments
addr
The user space address to retrieve the string from.
General Syntax
user_string_quoted:string(addr:long)
Description
Returns the null terminated C string from a given user space memory address where any ASCII characters that are not printable are replaced by the corresponding escape sequence in the returned string. Reports “NULL” for address zero. Returns “<unknown>” on the rare cases when userspace data is not accessible at the given address.
Name
function::user_string_n — Retrieves string of given length from user space.
Synopsis
function user_string_n:string(addr:long,n:long)
Arguments
addr
The user space address to retrieve the string from.
n
The maximum length of the string (if not null terminated).
General Syntax
user_string_n:string(addr:long, n:long)
Description
Returns the C string of a maximum given length from a given user space address. Returns “<unknown>” on the rare cases when userspace data is not accessible at the given address.
Name
function::user_string_n2 — Retrieves string of given length from user space.
Synopsis
function user_string_n2:string(addr:long,n:long,err_msg:string)
Arguments
addr
The user space address to retrieve the string from.
n
The maximum length of the string (if not null terminated).
err_msg
The error message to return when data isn't available.
General Syntax
user_string_n2:string(addr:long, n:long, err_msg:string)
Description
Returns the C string of a maximum given length from a given user space address. Returns the given error message string on the rare cases when userspace data is not accessible at the given address.
Name
function::user_string_n_warn — Retrieves string from user space.
Synopsis
function user_string_n_warn:string(addr:long,n:long)
Arguments
addr
The user space address to retrieve the string from.
n
The maximum length of the string (if not null terminated).
General Syntax
user_string_n_warn:string(addr:long, n:long)
Description
Returns up to n characters of a C string from a given user space memory address. Reports “<unknown>” on the rare cases when userspace data is not accessible and warns (but does not abort) about the failure.
Name
function::user_string_n_quoted — Retrieves and quotes string from user space.
Synopsis
function user_string_n_quoted:string(addr:long,n:long)
Arguments
addr
The user space address to retrieve the string from.
n
The maximum length of the string (if not null terminated).
General Syntax
user_string_n_quoted:string(addr:long, n:long)
Description
Returns up to n characters of a C string from the given user space memory address where any ASCII characters that are not printable are replaced by the corresponding escape sequence in the returned string. Reports “NULL” for address zero. Returns “<unknown>” on the rare cases when userspace data is not accessible at the given address.
Name
function::user_short — Retrieves a short value stored in user space.
Synopsis
function user_short:long(addr:long)
Arguments
addr
The user space address to retrieve the short from.
General Syntax
user_short:long(addr:long)
Description
Returns the short value from a given user space address. Returns zero when user space data is not accessible.
Name
function::user_short_warn — Retrieves a short value stored in user space.
Synopsis
function user_short_warn:long(addr:long)
Arguments
addr
The user space address to retrieve the short from.
General Syntax
user_short_warn:long(addr:long)
Description
Returns the short value from a given user space address. Returns zero when user space and warns (but does not abort) about the failure.
Name
function::user_int — Retrieves an int value stored in user space.
Synopsis
function user_int:long(addr:long)
Arguments
addr
The user space address to retrieve the int from.
General Syntax
user_int:long(addr:long)
Description
Returns the int value from a given user space address. Returns zero when user space data is not accessible.
Name
function::user_int_warn — Retrieves an int value stored in user space.
Synopsis
function user_int_warn:long(addr:long)
Arguments
addr
The user space address to retrieve the int from.
General Syntax
user_ing_warn:long(addr:long)
Description
Returns the int value from a given user space address. Returns zero when user space and warns (but does not abort) about the failure.
Name
function::user_long — Retrieves a long value stored in user space.
Synopsis
function user_long:long(addr:long)
Arguments
addr
The user space address to retrieve the long from.
General Syntax
user_long:long(addr:long)
Description
Returns the long value from a given user space address. Returns zero when user space data is not accessible. Note that the size of the long depends on the architecture of the current user space task (for those architectures that support both 64/32 bit compat tasks).
Name
function::user_long_warn — Retrieves a long value stored in user space.
Synopsis
function user_long_warn:long(addr:long)
Arguments
addr
The user space address to retrieve the long from.
General Syntax
user_long_warn:long(addr:long)
Description
Returns the long value from a given user space address. Returns zero when user space and warns (but does not abort) about the failure. Note that the size of the long depends on the architecture of the current user space task (for those architectures that support both 64/32 bit compat tasks).
Name
function::user_char — Retrieves a char value stored in user space.
Synopsis
function user_char:long(addr:long)
Arguments
addr
The user space address to retrieve the char from.
General Syntax
user_char:long(addr:long)
Description
Returns the char value from a given user space address. Returns zero when user space data is not accessible.
Name
function::user_char_warn — Retrieves a char value stored in user space.
Synopsis
function user_char_warn:long(addr:long)
Arguments
addr
The user space address to retrieve the char from.
General Syntax
user_char_warn:long(addr:long)
Description
Returns the char value from a given user space address. Returns zero when user space and warns (but does not abort) about the failure.
