1 files changed, 129 insertions, 0 deletions

diff --git a/listener/basefunc.go b/listener/basefunc.go
new file mode 100644
index 0000000..2f39507
--- /dev/null
+++ b/listener/basefunc.go
@@ -0,0 +1,129 @@
+package main
+
+import (
+        "bufio"
+        "fmt"
+        "os"
+        "os/exec"
+        "path/filepath"
+        "strconv"
+        "strings"
+        "time"
+)
+
+func figureOutSyscalls() error {
+        cmd := exec.Command("ausyscall", "--dump")
+        stdout, err := cmd.StdoutPipe()
+        if err != nil {
+                return err
+        }
+
+        if err := cmd.Start(); err != nil {
+                return err
+        }
+
+        scanner := bufio.NewScanner(stdout)
+        for i := 0; scanner.Scan(); i++ {
+                if i == 0 {
+                        continue
+                }
+                line := scanner.Text()
+                parts := strings.Split(line, "\t")
+                if len(parts) != 2 {
+                        return fmt.Errorf("invalid ausyscall format")
+                }
+                num, err := strconv.Atoi(parts[0])
+                if err != nil {
+                        return err
+                }
+                syscallTable[num] = parts[1]
+        }
+
+        if err := scanner.Err(); err != nil {
+                return err
+        }
+        if err := cmd.Wait(); err != nil {
+                return err
+        }
+        return nil
+}
+
+func getPid() (int, error) {
+        // 指定要搜索的关键词
+        keyword := "/usr/bin/containerd"
+
+        // 获取/proc目录下的所有子目录
+        procDir, err := filepath.Glob("/proc/*")
+        if err != nil {
+                return 0, err
+        }
+
+        // 遍历子目录，查找包含关键词的进程
+        for _, dir := range procDir {
+                pid, err := strconv.Atoi(filepath.Base(dir))
+                if err != nil {
+                        continue // 跳过非PID的目录
+                }
+
+                // 检查进程是否包含关键词
+                if containsKeyword(pid, keyword) {
+                        return pid, nil
+                }
+        }
+        err = fmt.Errorf("Error: no containerd process found.")
+        return 0, err
+}
+
+func containsKeyword(pid int, keyword string) bool {
+        // 构造完整的进程命令路径
+        cmdPath := fmt.Sprintf("/proc/%d/cmdline", pid)
+
+        // 打开文件
+        file, err := os.Open(cmdPath)
+        if err != nil {
+                return false
+        }
+        defer file.Close()
+
+        // 读取文件内容
+        scanner := bufio.NewScanner(file)
+        scanner.Split(bufio.ScanLines)
+        for scanner.Scan() {
+                line := scanner.Text()
+                if strings.Contains(line, keyword) {
+                        return true
+                }
+        }
+        return false
+}
+
+func getTimeFromStr(timeStr string) (time.Time, error) {
+        timestampFloat, err := strconv.ParseFloat(timeStr, 64)
+        if err != nil {
+                return time.Unix(0, 0), err
+        }
+        secs := int64(timestampFloat)
+        nsecs := int64((timestampFloat - float64(secs)) * 1e9)
+
+        // 只精确到毫秒就够了
+        t := time.Unix(secs, nsecs).Truncate(time.Millisecond)
+        return t, nil
+}
+
+func hexToAscii(hexString string) string {
+        bytes := []byte{}
+        for i := 0; i < len(hexString); i += 2 {
+                hexPair := hexString[i : i+2]
+                // 将十六进制数转换为十进制数
+                decimal, err := strconv.ParseInt(hexPair, 16, 8)
+                if err != nil {
+                        return "Invalid hex string"
+                }
+                char := byte(decimal)
+                bytes = append(bytes, char)
+        }
+
+        asciiString := strings.ReplaceAll(string(bytes), "\000", " ")
+
+        return asciiString
+}