AlignDown rounds a down to an alignment.

AlignUp rounds a length up to an alignment.

CaptureAddress pulls a socket address from the process as a byte slice.

GetAddress reads an sockaddr struct from the given address and converts it to the FullAddress format.

New returns a new Tracer.

NewProcReader returns an io.Reader for a ProcIO.

NewProcWriter returns an io.Writer for a ProcIO.

NewTracerChild creates a tracer from a tracer.

ReadMessageHeader64 reads a MessageHeader64.

Run runs a set of processes as defined by a Tracer.

SysCall takes a Tracer and a TraceRecord and adds prettyprint to the TraceRecord.

Wait will wait for the specified pid using Wait4.

CloneFlags are clone(2) flags.

DefaultLogMaximumSize is the default LogMaximumSize.

ExecMaxElemSize is the maximum length of a single argv or envv entry.

ExecMaxTotalSize is the maximum length of all argv and envv entries.

ExecveStringVector is a NULL-terminated array of strings.

FutexOp is the futex(2) operation.

Hex is just a hexadecimal number.

IOVec is a generic pointer to a struct iovec.

ItimerSpec is a pointer to a struct itimerspec.

ItimerType is an itimer type (ITIMER_REAL, etc).

ItimerVal is a pointer to a struct itimerval.

Mode is a mode_t.

Oct is just an octal number.

OpenFlags are open(2) flags.

Path is a pointer to a char* path.

PipeFDs is an array of two FDs, formatted after syscall execution.

PostItimerSpec is a pointer to a struct itimerspec, formatted after syscall execution.

PostItimerVal is a pointer to a struct itimerval, formatted after syscall execution.

PostPath is a pointer to a char* path, formatted after syscall execution.

PostSockAddr is a pointer to a struct sockaddr, formatted after syscall execution.

PostTimespec is a pointer to a struct timespec, formatted after syscall execution.

PtraceRequest is the ptrace(2) request.

ReadBuffer is a buffer for a read-style call.

ReadIOVec is a pointer to a struct iovec for a writev-style call.

RecvMsgHdr is a pointer to a struct msghdr for a recvmsg-style call.

Rusage is a struct rusage, formatted after syscall execution.

SendMsgHdr is a pointer to a struct msghdr for a sendmsg-style call.

SockAddr is a pointer to a struct sockaddr.

SockFamily is a socket protocol family value.

SockFlags are socket flags.

SockLen is a pointer to a socklen_t, formatted before and after syscall execution.

SockProtocol is a socket protocol value.

SockType is a socket type and flags value.

Stat is a pointer to a struct stat, formatted after syscall execution.

Timespec is a pointer to a struct timespec.

Timeval is a pointer to a struct timeval, formatted before and after syscall execution.

Uname is a pointer to a struct uname, formatted after syscall execution.

Utimbuf is a pointer to a struct utimbuf.

UTimeTimespec is a pointer to a struct timespec.

WriteBuffer is a buffer for a write-style call.

WriteIOVec is a pointer to a struct iovec for a writev-style call.

Debug is a do-nothing function which can be replaced by, e.g., log.Printf.

EventMaximumSize determines the maximum size for data blobs (read, write, etc.) sent over the event channel.

LogMaximumSize determines the maximum display size for data blobs (read, write, etc.).

A ProcIO is used to implement io.Reader and io.Writer.

SyscallArgument is an argument supplied to a syscall implementation.

SyscallInfo captures the name and printing format of a syscall.

Tracer has information to trace one process.

TraceRecord has information about a ptrace event.

Addr is an address for use in strace I/O.

Address is a byte slice cast as a string that represents the address of a network node.

Arg is the argument type for system calls.

EventType describes whether a record is system call Entry or Exit.

FormatSpecifier values describe how an individual syscall argument should be formatted.

SyscallArguments represents the set of arguments passed to a syscall.

SyscallMap maps syscalls into names and printing formats.