package main import ( "bufio" "fmt" "os" "os/exec" "path/filepath" "strconv" "strings" "time" ) func figureOutSyscalls() error { cmd := exec.Command("ausyscall", "--dump") stdout, err := cmd.StdoutPipe() if err != nil { return err } if err := cmd.Start(); err != nil { return err } scanner := bufio.NewScanner(stdout) for i := 0; scanner.Scan(); i++ { if i == 0 { continue } line := scanner.Text() parts := strings.Split(line, "\t") if len(parts) != 2 { return fmt.Errorf("invalid ausyscall format") } num, err := strconv.Atoi(parts[0]) if err != nil { return err } syscallTable[num] = parts[1] } if err := scanner.Err(); err != nil { return err } if err := cmd.Wait(); err != nil { return err } return nil } func getPid() (int, error) { // 指定要搜索的关键词 keyword := "/usr/bin/containerd" // 获取/proc目录下的所有子目录 procDir, err := filepath.Glob("/proc/*") if err != nil { return 0, err } // 遍历子目录,查找包含关键词的进程 for _, dir := range procDir { pid, err := strconv.Atoi(filepath.Base(dir)) if err != nil { continue // 跳过非PID的目录 } // 检查进程是否包含关键词 if containsKeyword(pid, keyword) { return pid, nil } } err = fmt.Errorf("Error: no containerd process found.") return 0, err } func containsKeyword(pid int, keyword string) bool { // 构造完整的进程命令路径 cmdPath := fmt.Sprintf("/proc/%d/cmdline", pid) // 打开文件 file, err := os.Open(cmdPath) if err != nil { return false } defer file.Close() // 读取文件内容 scanner := bufio.NewScanner(file) scanner.Split(bufio.ScanLines) for scanner.Scan() { line := scanner.Text() if strings.Contains(line, keyword) { return true } } return false } func getTimeFromStr(timeStr string) (time.Time, error) { timestampFloat, err := strconv.ParseFloat(timeStr, 64) if err != nil { return time.Unix(0, 0), err } secs := int64(timestampFloat) nsecs := int64((timestampFloat - float64(secs)) * 1e9) // 只精确到毫秒就够了 t := time.Unix(secs, nsecs).Truncate(time.Millisecond) return t, nil } func hexToAscii(hexString string) string { bytes := []byte{} for i := 0; i < len(hexString); i += 2 { hexPair := hexString[i : i+2] // 将十六进制数转换为十进制数 decimal, err := strconv.ParseInt(hexPair, 16, 8) if err != nil { return "Invalid hex string" } char := byte(decimal) bytes = append(bytes, char) } asciiString := strings.ReplaceAll(string(bytes), "\000", " ") return asciiString }