NAME¶

function::kernel_buffer_quoted - Retrieves and quotes buffer from kernel space

SYNOPSIS¶

1) kernel_buffer_quoted:string(addr:long,inlen:long)

2) kernel_buffer_quoted:string(addr:long,inlen:long,outlen:long)

ARGUMENTS¶

addr

inlen

outlen

DESCRIPTION¶

1) Reads inlen characters of a buffer from the given kernel space memory address, and returns up to MAXSTRINGLEN characters, where any ASCII characters that are not printable are replaced by the corresponding escape sequence in the returned string. Note that the string will be surrounded by double quotes. On the rare cases when kernel space data is not accessible at the given address, the address itself is returned as a string, without double quotes.

2) Reads inlen characters of a buffer from the given kernel space memory address, and returns up to outlen characters, where any ASCII characters that are not printable are replaced by the corresponding escape sequence in the returned string. Note that the string will be surrounded by double quotes. On the rare cases when kernel space data is not accessible at the given address, the address itself is returned as a string, without double quotes.

SEE ALSO0¶

tapset::conversions(3stap)