feat: add reverse lookup for uprobe symbols

Signed-off-by: Max Altgelt <max.altgelt@nextron-systems.com>

Author: secDre4mer

link/link_other.go

@@ -272,6 +272,26 @@ func (umi *UprobeMultiInfo) Offsets() ([]UprobeMultiOffset, bool) {
 	return adresses, true
 }
 
+// Symbols returns the symbols that the uprobe was attached to.
+func (umi *UprobeMultiInfo) Symbols() ([]UprobeSymbol, error) {
+	if umi.offsets == nil {
+		return nil, fmt.Errorf("no offsets available")
+	}
+	ex, err := OpenExecutable(umi.path)
+	if err != nil {
+		return nil, err
+	}
+	var symbols []UprobeSymbol
+	for i := range umi.offsets {
+		symbol, err := ex.Symbol(umi.offsets[i])
+		if err != nil {
+			return nil, err
+		}
+		symbols = append(symbols, symbol)
+	}
+	return symbols, nil
+}
+
 func (umi *UprobeMultiInfo) Path() string {
 	return umi.path
 }
@@ -340,6 +360,19 @@ type UprobeInfo struct {
 	RefCtrOffset uint64
 }
 
+type UprobeSymbol struct {
+	Symbol string
+	Offset uint64
+}
+
+func (u *UprobeInfo) Symbol() (UprobeSymbol, error) {
+	ex, err := OpenExecutable(u.File)
+	if err != nil {
+		return UprobeSymbol{}, err
+	}
+	return ex.Symbol(uint64(u.Offset))
+}
+
 type TracepointInfo struct {
 	Tracepoint string
 	Cookie     uint64

link/uprobe.go

@@ -39,11 +39,16 @@ type Executable struct {
 	// Path of the executable on the filesystem.
 	path string
 	// Parsed ELF and dynamic symbols' cachedAddresses.
-	cachedAddresses map[string]uint64
+	cachedAddresses map[string]symbolAddress
 	// Keep track of symbol table lazy load.
 	cacheAddressesOnce sync.Once
 }
 
+type symbolAddress struct {
+	addr uint64
+	size uint64
+}
+
 // UprobeOptions defines additional parameters that will be used
 // when loading Uprobes.
 type UprobeOptions struct {
@@ -111,7 +116,7 @@ func OpenExecutable(path string) (*Executable, error) {
 
 	return &Executable{
 		path:            path,
-		cachedAddresses: make(map[string]uint64),
+		cachedAddresses: make(map[string]symbolAddress),
 	}, nil
 }
 
@@ -155,20 +160,16 @@ func (ex *Executable) load(f *internal.SafeELFFile) error {
 			}
 		}
 
-		ex.cachedAddresses[s.Name] = address
+		ex.cachedAddresses[s.Name] = symbolAddress{
+			addr: address,
+			size: s.Size,
+		}
 	}
 
 	return nil
 }
 
-// address calculates the address of a symbol in the executable.
-//
-// opts must not be nil.
-func (ex *Executable) address(symbol string, address, offset uint64) (uint64, error) {
-	if address > 0 {
-		return address + offset, nil
-	}
-
+func (ex *Executable) lazyLoadSymbols() error {
 	var err error
 	ex.cacheAddressesOnce.Do(func() {
 		var f *internal.SafeELFFile
@@ -181,11 +182,23 @@ func (ex *Executable) address(symbol string, address, offset uint64) (uint64, er
 
 		err = ex.load(f)
 	})
+	return err
+}
+
+// address calculates the address of a symbol in the executable.
+//
+// opts must not be nil.
+func (ex *Executable) address(symbol string, address, offset uint64) (uint64, error) {
+	if address > 0 {
+		return address + offset, nil
+	}
+
+	err := ex.lazyLoadSymbols()
 	if err != nil {
 		return 0, fmt.Errorf("lazy load symbols: %w", err)
 	}
 
-	address, ok := ex.cachedAddresses[symbol]
+	symaddress, ok := ex.cachedAddresses[symbol]
 	if !ok {
 		return 0, fmt.Errorf("symbol %s: %w", symbol, ErrNoSymbol)
 	}
@@ -196,12 +209,30 @@ func (ex *Executable) address(symbol string, address, offset uint64) (uint64, er
 	//
 	// Since only offset values are stored and not elf.Symbol, if the value is 0,
 	// assume it's an external symbol.
-	if address == 0 {
+	if symaddress.addr == 0 {
 		return 0, fmt.Errorf("cannot resolve %s library call '%s': %w "+
 			"(consider providing UprobeOptions.Address)", ex.path, symbol, ErrNotSupported)
 	}
 
-	return address + offset, nil
+	if offset >= symaddress.size {
+		return 0, fmt.Errorf("offset %d is out of range of symbol %s", offset, symbol)
+	}
+
+	return symaddress.addr + offset, nil
+}
+
+// Symbol calculates the symbol and offset for an address in the executable.
+func (ex *Executable) Symbol(address uint64) (UprobeSymbol, error) {
+	if err := ex.lazyLoadSymbols(); err != nil {
+		return UprobeSymbol{}, fmt.Errorf("lazy load symbols: %w", err)
+	}
+
+	for name, symaddress := range ex.cachedAddresses {
+		if symaddress.addr <= address && symaddress.addr+symaddress.size > address {
+			return UprobeSymbol{name, address - symaddress.addr}, nil
+		}
+	}
+	return UprobeSymbol{}, ErrNoSymbol
 }
 
 // Uprobe attaches the given eBPF program to a perf event that fires when the

link/uprobe_multi_test.go

@@ -61,6 +61,16 @@ func TestUprobeMultiInfo(t *testing.T) {
 	uprobeOffsets, ok := uprobeDetails.Offsets()
 	qt.Assert(t, qt.IsTrue(ok))
 	qt.Assert(t, qt.HasLen(uprobeOffsets, len(bashSyms)))
+	syms, err := uprobeDetails.Symbols()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var symnames = make([]string, len(syms))
+	for i, sym := range syms {
+		qt.Assert(t, qt.Equals(sym.Offset, 0))
+		symnames[i] = sym.Symbol
+	}
+	qt.Assert(t, qt.ContentEquals(symnames, bashSyms))
 }
 
 func TestUprobeMultiInput(t *testing.T) {

link/uprobe_test.go

@@ -124,6 +124,10 @@ func TestUprobeInfo(t *testing.T) {
 	qt.Assert(t, qt.Equals(eventInfo.Type, PerfEventUprobe))
 	uprobeInfo := eventInfo.Uprobe()
 	qt.Assert(t, qt.StringContains(uprobeInfo.File, bashEx.path))
+	sym, err := uprobeInfo.Symbol()
+	qt.Assert(t, qt.IsNil(err))
+	qt.Assert(t, qt.Equals(sym.Symbol, bashSym))
+	qt.Assert(t, qt.Equals(sym.Offset, 0))
 }
 
 func TestUprobeExtNotFound(t *testing.T) {