feat(crit): add SearchPattern method on MemoryReader

[behouba]

I am currently working on a feature to allow users to search for a pattern within process memory pages, as suggested by @rst0git last year. This could be used to extend checkpointctl memparse with search capability.

Currently, the method SearchPattern(pattern string) (uint64, error) takes the pattern to search as an argument and returns the address of the first match along with an error if the pattern is not found. I am not sure about the implementation yet, and I'm considering alternative approaches:

• Instead of providing just the address of the first match, should we consider returning the entire memory pages where the pattern is found?

• Another consideration is whether to return not just the first match but all occurrences of the pattern.

@rst0git, @adrianreber , @snprajwal PTAL.

[codecov]

Codecov Report

Attention: Patch coverage is 84.00000% with 8 lines in your changes missing coverage. Please review.

Project coverage is 50.82%. Comparing base (ce0a56d) to head (20dfec8).
Report is 5 commits behind head on master.

Files	Patch %	Lines
crit/mempages.go	84.00%	5 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #163      +/-   ##
==========================================
+ Coverage   48.13%   50.82%   +2.68%     
==========================================
  Files          21       21              
  Lines        2279     1948     -331     
==========================================
- Hits         1097      990     -107     
+ Misses       1050      819     -231     
- Partials      132      139       +7     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[adrianreber]

Another consideration is whether to return not just the first match but all occurrences of the pattern.

That would kind of match the behaviour of grep. That is also what I would expect when searching for a pattern.

Instead of providing just the address of the first match, should we consider returning the entire memory pages where the pattern is found?

Maybe not as default, but with an additional option. Maybe like the context option from grep. Where you can say how many lines before and after the match. A whole page on the terminal sounds a lot, so if you let the user select how many bytes to show, that sounds like a useful option to me.

[behouba]

I have updated the SearchPattern method. Now, the function takes both the pattern and a context (specified by the number of bytes before and after the pattern). I opted for byte counts instead of line counts, considering the content of pages-*.img files, which doesn't neatly correspond to lines.
Also, the function now returns a slice of strings representing all occurrences of the pattern found in memory.

cc: @adrianreber , @rst0git , @snprajwal

[snprajwal]

@behouba dropping a note to check if you're still working on this :)

[behouba]

@behouba dropping a note to check if you're still working on this :)

Hi @snprajwal! Yes, I am still working on it :)
I will soon open a draft PR on checkpointctl so we can assess the potential performance issues with the current implementation.

[snprajwal]

LGTM

[rst0git]

@behouba Thank you for working on this feature and updating the pull request!
Would it be possible to apply the recent changes in the PR for checkpointctl to test it before we merge this pull request?

[rst0git]

LGTM