Weaver

Weaver is a CLI tool that allows you to trace Go programs in order to inspect what values are passed to specified functions. It leverages eBPF attached to uprobes.

Quick Start

Take the following example program:

test_prog.go

package main

//go:noinline
func test_function(int, [2]int) {}

//go:noinline
func other_test_function(rune, int64) {}

func main() {
	test_function(3, [2]int{1, 2})
	other_test_function('a', 33)
}

Let's say we want to know what values are passed to test_function and other_test_function whenever the program is run. Once the program is compiled (make) we just have to create a file which specifies each function to trace:

functions_to_trace.txt

main.test_function(int, [2]int)
main.other_test_function(rune, int64)

Notice that we have to specify the parameter data types. (You can use weaver --types to see what data types are supported.)

Now we can call weaver like so:

sudo weaver -f /path/to/functions_to_trace.txt /path/to/test-prog-binary

Weaver will then sit idle without any output until test-prog is run and the test_function and other_test_function functions are called. This will also work on an already running Go Program.

+--------------------+--------------+-----------+-------+
|   FUNCTION NAME    | ARG POSITION |   TYPE    | VALUE |
+--------------------+--------------+-----------+-------+
| main.test_function | 0            | INT       | 3     |
| main.test_function | 1            | INT_ARRAY | 1, 2  |
+--------------------+--------------+-----------+-------+
+--------------------------+--------------+-------+-------+
|      FUNCTION NAME       | ARG POSITION | TYPE  | VALUE |
+--------------------------+--------------+-------+-------+
| main.other_test_function | 0            | RUNE  | a     |
| main.other_test_function | 1            | INT64 | 33    |
+--------------------------+--------------+-------+-------+

Note on supported types

Currently weaver supports basic data types but getting support for user defined types is a high priority. Getting following types defined are also a work in progress:

• arbitrary pointers
• slices
• user/stdlib defined structs
• user/stdlib defined interfaces

Dependencies

• bcc
• linux kernel version > 4.14 (please make bug reports if your kernel version doesn't work)

Build

make weaver will compile the weaver binary to bin/weaver

Can't build? Please make an issue!

Roadmap

Check issues for tasks currently being tracked. Please open bug reports, i'm sure there are plenty :-)

Short term goals include:

• Testing
• Output options
• Deep pointer inspection
• Inspecting binaries for parameter data types instead of specifying them at the command line
• CI/CD infrastructre

image modified version of art by Ashley McNamara (license) based on art by Renee French.