feat(crit): add SearchPattern method on MemoryReader

[behouba]

I am currently working on a feature to allow users to search for a pattern within process memory pages, as suggested by @rst0git last year. This could be used to extend checkpointctl memparse with search capability.

Currently, the method SearchPattern(pattern string) (uint64, error) takes the pattern to search as an argument and returns the address of the first match along with an error if the pattern is not found. I am not sure about the implementation yet, and I'm considering alternative approaches:

• Instead of providing just the address of the first match, should we consider returning the entire memory pages where the pattern is found?

• Another consideration is whether to return not just the first match but all occurrences of the pattern.

@rst0git, @adrianreber , @snprajwal PTAL.

[codecov]

Codecov Report

Attention: Patch coverage is 86.36364% with 6 lines in your changes are missing coverage. Please review.

Project coverage is 50.06%. Comparing base (972bd31) to head (2a6f42a).

Files	Patch %	Lines
crit/mempages.go	86.36%	4 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #163      +/-   ##
==========================================
+ Coverage   49.38%   50.06%   +0.67%     
==========================================
  Files          22       22              
  Lines        2359     2403      +44     
==========================================
+ Hits         1165     1203      +38     
- Misses       1058     1062       +4     
- Partials      136      138       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[adrianreber]

Another consideration is whether to return not just the first match but all occurrences of the pattern.

That would kind of match the behaviour of grep. That is also what I would expect when searching for a pattern.

Instead of providing just the address of the first match, should we consider returning the entire memory pages where the pattern is found?

Maybe not as default, but with an additional option. Maybe like the context option from grep. Where you can say how many lines before and after the match. A whole page on the terminal sounds a lot, so if you let the user select how many bytes to show, that sounds like a useful option to me.

[behouba]

I have updated the SearchPattern method. Now, the function takes both the pattern and a context (specified by the number of bytes before and after the pattern). I opted for byte counts instead of line counts, considering the content of pages-*.img files, which doesn't neatly correspond to lines.
Also, the function now returns a slice of strings representing all occurrences of the pattern found in memory.

cc: @adrianreber , @rst0git , @snprajwal

[rst0git]

@behouba What would be the performance of the search functionality if we have a container checkpoint that has pages file larger than 100 GB and checkpointctl is running on a laptop with 16 GB memory?

[behouba]

I guess this laptop will run out of memory because the function will try to read the entire 100GB at once.
Thank you @rst0git for pointing this out. I will work on an optimization alternative.

[rst0git]

I guess this laptop will run out of memory because the function will try to read the entire 100GB at once.

I'm not sure. It looks like getPage() reads one page at a time. However, if we have a checkpoint with 100 GB pages file (≈ 26,214,400 pages), the search functionality might be very slow.

It might be useful to create a draft PR for checkpointctl so that we can evaluate the performance and optimise it.

[snprajwal]

@behouba dropping a note to check if you're still working on this :)

[behouba]

@behouba dropping a note to check if you're still working on this :)

Hi @snprajwal! Yes, I am still working on it :)
I will soon open a draft PR on checkpointctl so we can assess the potential performance issues with the current implementation.