Proctal

Documentation

Search techniques

This is a compilation of techniques on how the search command can be used.

Only print addresses

You can grab the addresses with awk.

$ proctal search --pid=12345 --type=integer --eq=42 | awk '{ print $1 }'
7F7BE73B9638
7F7BE73B967C
7F7BE75DFA40
7F7BE75E0714
7F7BE75ED1A0
7FFC64E15EF0
7FFC64E16514
[...]

IEEE754 number with any decimal part

This approach is wrong:

$ proctal search --pid=12345 --type=ieee754 --eq=2

That would only match numbers that are exactly 2, not 2.1, not 2.000001.
What you need to do is to search for all numbers that are greater than or equal to 2 and less than 3.

$ proctal search --pid=12345 --type=ieee754 --gte=2 --lt=3

Counting matches

You can get the number of matches by counting how many lines the output has because every match is displayed in its own line.
It's impractical to count all the lines manually, though. You may have hundreds or thousands.
Use the wc program with the -l option. It will count the number of lines passed to the standard input stream or a file if you pass its name as an argument.
The following example shows you the output of the search command being piped to wc and displaying the number of matches:

$ proctal search --pid=12345 --type=ieee754 --eq=2 | wc -l
2562

This example uses a file:

$ proctal search --pid=12345 --type=ieee754 --eq=2 > search-results
$ wc -l search-results
2562 search-results

You may also just redirect the contents of the file if you do not want to see the file name in the output of wc.

$ wc -l < search-results
2562

Watch results

The watch program can run a command repeatedly. You can have it run the search command which allows you to watch the search results change over time. By default it runs the command every 2 seconds.

$ watch proctal search --pid=12345 --type=integer --integer-bits=8 --eq=53
Every 2.0s: proctal search --pid=12345 --type=integer --integer-bits=8 --eq=53
7FCDB1D577F8 53
7FCDB1D57F38 53
7FCDB1D58738 53
7FCDB1D58BA8 53
[...]

The interval can be changed by passing the -n option with the number of seconds. You can use decimal numbers but you cannot go lower than 100 milliseconds.
Here's how you would set the interval to 500 milliseconds:

$ watch -n 0.5 proctal search --pid=12345 --type=integer --integer-bits=8 --eq=53
Every 0.5s: proctal search --pid=12345 --type=integer --integer-bits=8 --eq=53
7FCDB1D577F8 53
7FCDB1D57F38 53
7FCDB1D58738 53
7FCDB1D58BA8 53
[...]

If you're going to redirect the input stream to read from a file for the --review option, you need to escape the redirection operator otherwise the watch program won't see it because the shell will interpret it first.

$ watch proctal search --pid=12345 --type=integer --integer-bits=8 --review '<' results2
Every 2.0s: proctal search --pid=12345 --type=integer --integer-bits=8 --review < results2
7FCDB1D577F8 53
7FCDB1D57F38 53
7FCDB1D58738 53
7FCDB1D58BA8 53
[...]

If all the results don't fit on a single page, you can pipe the output to the tail program which allows you to specify an offset.
Here's how you would skip the first 150 lines:

$ watch 'proctal search --pid=12345 --type=integer --integer-bits=8 --review < results2 | tail -n +150 -'
Every 2.0s: proctal search --pid=12345 --type=integer --integer-bits=8 --review < results2 | tail -n +150 -
7FCDB1D63AF4 53
7FCDB1D65C34 53
7FCDB1D78234 53
7FCDB1D788B8 53

You can stop watch by sending it the SIGINT signal.

Previous Next