FUNCTION::KERNEL_BUF

Section: String and data retrieving fun (3stap)
Updated: November 2022
Index Return to Main Contents

NAME

function::kernel_buffer_quoted - Retrieves and quotes buffer from kernel space

SYNOPSIS

1) kernel_buffer_quoted:string(addr:long,inlen:long)

2) kernel_buffer_quoted:string(addr:long,inlen:long,outlen:long)

ARGUMENTS

addr

: the kernel space address to retrieve the buffer from

inlen

: the exact length of the buffer to read

outlen

: the maximum length of the output string

DESCRIPTION

1) Reads inlen characters of a buffer from the given kernel space memory address, and returns up to MAXSTRINGLEN characters, where any ASCII characters that are not printable are replaced by the corresponding escape sequence in the returned string. Note that the string will be surrounded by double quotes. On the rare cases when kernel space data is not accessible at the given address, the address itself is returned as a string, without double quotes.

2) Reads inlen characters of a buffer from the given kernel space memory address, and returns up to outlen characters, where any ASCII characters that are not printable are replaced by the corresponding escape sequence in the returned string. Note that the string will be surrounded by double quotes. On the rare cases when kernel space data is not accessible at the given address, the address itself is returned as a string, without double quotes.