Method processCallstack

pkg/symbolize/symbolizer.go:289–402

(e *event.Event)

}

func (s *Symbolizer) processCallstack(e *event.Event) error {
	addrs := e.Params.MustGetSliceAddrs(params.Callstack)
	e.Callstack.Init(len(addrs))

	// skip stack enrichment for the events generated by the System process
	// except the LoadModule event which may prove to be useful when the
	// driver is loaded and the kernel address symbolization is enabled
	if e.IsSystemPid() && !e.IsLoadModule() {
		return nil
	}

	s.mu.Lock()
	defer s.mu.Unlock()

	if e.PS != nil {
		var (
			addr va.Address
			pid  uint32
		)

		// get the address that we want to symbolize
		switch e.Type {
		case event.CreateThread:
			pid = e.Params.MustGetPid()
			addr = e.Params.TryGetAddress(params.StartAddress)
		case event.SubmitThreadpoolWork, event.SubmitThreadpoolCallback:
			pid = e.PID
			addr = e.Params.TryGetAddress(params.ThreadpoolCallback)
		}

		// symbolize thread start or thread pool callback address
		// and resolve the module name that contains the function
		if addr != 0 {
			mod := e.PS.FindModuleByVa(addr)
			// perform lookup against parent modules
			if mod == nil && e.PS.Parent != nil {
				mod = e.PS.Parent.FindModuleByVa(addr)
			}
			symbol := s.symbolizeAddress(pid, addr, mod)

			if symbol != "" && symbol != "?" {
				switch e.Type {
				case event.CreateThread:
					e.Params.Append(params.StartAddressSymbol, params.UnicodeString, symbol)
				case event.SubmitThreadpoolWork, event.SubmitThreadpoolCallback:
					e.Params.Append(params.ThreadpoolCallbackSymbol, params.UnicodeString, symbol)

					ctx := e.Params.TryGetAddress(params.ThreadpoolContext)

					// if the callback resolves to one of the functions
					// that receive the CONTEXT structure as a parameter
					// try to read the thread context and resolve the
					// function address stored in the instruction pointer
					if ctx != 0 && threadcontext.IsParamOfFunc(symbol) {
						rip := threadcontext.Rip(pid, ctx)
						if rip != 0 {
							e.Params.Append(params.ThreadpoolContextRip, params.Address, rip.Uint64())