79727930

Date: 2025-08-06 22:53:57
Score: 0.5
Natty:
Report link

ANSWER:

Bpftrace fishes the register contents out of the struct pt_regs which gets from the ptrace interface. It gets the offsets into the struct using this snippet of code: (bpftrace github)


static const std::unordered_map<std::string, size_t> register_offsets = {

{ "r15", 0 },  { "r14", 8 },  { "r13", 16 },    { "r12", 24 },

{ "bp", 32 },  { "bx", 40 },  { "r11", 48 },    { "r10", 56 },

{ "r9", 64 },  { "r8", 72 },  { "ax", 80 },     { "cx", 88 },

{ "dx", 96 },  { "si", 104 }, { "di", 112 },    { "orig_rax", 120 },

{ "ip", 128 }, { "cs", 136 }, { "flags", 144 }, { "sp", 152 },

{ "ss", 160 },

};

Reasons:
  • Long answer (-0.5):
  • Has code block (-0.5):
  • Self-answer (0.5):
  • Low reputation (1):
Posted by: joachim Bose