feat!: data field decode types

go.mod

@@ -173,3 +173,5 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	kernel.org/pub/linux/libs/security/libcap/psx v1.2.70 // indirect
 )
+
+replace github.com/aquasecurity/tracee/types => ./types

pkg/bufferdecoder/decoder.go

@@ -39,8 +39,14 @@ func (decoder *EbpfDecoder) BuffLen() int {
 	return len(decoder.buffer)
 }
 
-// ReadAmountBytes returns the total amount of bytes that decoder has read from its buffer up until now.
-func (decoder *EbpfDecoder) ReadAmountBytes() int {
+// BytesRead returns the total amount of bytes that decoder has read from its buffer up until now.
+func (decoder *EbpfDecoder) BytesRead() int {
+	return decoder.cursor
+}
+
+// MoveCursor moves the buffer cursor over n bytes. Returns the new cursor position.
+func (decoder *EbpfDecoder) MoveCursor(n int) int {
+	decoder.cursor += n
 	return decoder.cursor
 }
 
@@ -107,7 +113,7 @@ func (decoder *EbpfDecoder) DecodeArguments(args []trace.Argument, argnum int, e
 		args[idx] = arg
 	}
 
-	// Fill missing arguments metadata
+	// Fill missing arguments
 	for i := 0; i < len(evtFields); i++ {
 		if args[i].Value == nil {
 			args[i].ArgMeta = evtFields[i]
@@ -260,8 +266,20 @@ func (decoder *EbpfDecoder) DecodeBytes(msg []byte, size int) error {
 	return nil
 }
 
-// DecodeIntArray translate from the decoder buffer, starting from the decoder cursor, to msg, size * 4 bytes (in order to get int32).
-func (decoder *EbpfDecoder) DecodeIntArray(msg []int32, size int) error {
+// ReadBytesLen is a helper which allocates a known size bytes buffer and decodes
+// the bytes from the buffer into it.
+func (decoder *EbpfDecoder) ReadBytesLen(len int) ([]byte, error) {
+	var err error
+	res := make([]byte, len)
+	err = decoder.DecodeBytes(res[:], len)
+	if err != nil {
+		return nil, errfmt.Errorf("error reading byte array: %v", err)
+	}
+	return res, nil
+}
+
+// DecodeInt32Array translate from the decoder buffer, starting from the decoder cursor, to msg, size * 4 bytes (in order to get int32).
+func (decoder *EbpfDecoder) DecodeInt32Array(msg []int32, size int) error {
 	offset := decoder.cursor
 	if len(decoder.buffer[offset:]) < size*4 {
 		return ErrBufferTooShort

pkg/bufferdecoder/decoder_test.go

@@ -354,7 +354,7 @@ func TestDecodeIntArray(t *testing.T) {
 	raw = append(raw, 1, 2, 3, 4, 5, 6, 7, 8)
 	decoder := New(raw)
 	var obtained [2]int32
-	err := decoder.DecodeIntArray(obtained[:], 2)
+	err := decoder.DecodeInt32Array(obtained[:], 2)
 	assert.Equal(t, nil, err)
 	rawcp := append(raw, 1, 2, 3, 4, 5, 6, 7, 8)
 	dataBuff := bytes.NewBuffer(rawcp)