fix empty arguments resolution

[ShohamBit]

1. Explain what the PR does

• fix issue Failure in argument name resolution results in empty value #3892
• run make -f /builder/Makefile.man

"Replace me with make check-pr output"

2. Explain how to test it

change empty sting to hex value

3. Other comments

Resolves #3892

[yanivagman]

Let's change all parsers inside this file that currently return an empty value on an error to return the raw value instead

[ShohamBit]

Let's change all parsers inside this file that currently return an empty value on an error to return the raw value instead.

Okay, but I think the code is still going to look weird because if we just print the information without any need for processing it behind the scenes, why would we write the function like this:

func funcArg(arg *trace.Argument, val uint64) {
    arg.Type = "string"
    argument, err := parsers.funcArg(mode) 
    if err != nil {
        arg.Value = "" 
        return 
    }
    arg.Value = argument.String() 
}

instead of like this:

func funcArg(arg *tracee.Argument, val uint64) {
    arg.Type = "string"
    arg.Value = val 
}

or just remove it entirely?

It looks pretty weird that we check for an error and don't even use it.

Note: Not every function behaves like this, but most of them do.

[oshaked1]

It looks pretty weird that we check for an error and don't even use it.

We do use the error, that way we know to use the raw value.

[oshaked1]

If the raw value is used, the value type is inconsistent. We should either change the type accordingly or format the raw value as a string (preferrable in my opinion).

[yanivagman]

I agree - better to format the raw argument as a string

[ShohamBit]

Yes, that sounds good. However, as discussed earlier, raw values are used when Tracee can't identify the data. In this code, forming the raw value isn't the best practice because that happens in the pkg/parsers module.

[oshaked1]

Same as above

[yanivagman]

Let's change all parsers inside this file that currently return an empty value on an error to return the raw value instead.

Okay, but I think the code is still going to look weird because if we just print the information without any need for processing it behind the scenes, why would we write the function like this:

func funcArg(arg *trace.Argument, val uint64) {
    arg.Type = "string"
    argument, err := parsers.funcArg(mode) 
    if err != nil {
        arg.Value = "" 
        return 
    }
    arg.Value = argument.String() 
}

instead of like this:

func funcArg(arg *tracee.Argument, val uint64) {
    arg.Type = "string"
    arg.Value = val 
}

or just remove it entirely?

It looks pretty weird that we check for an error and don't even use it.

Note: Not every function behaves like this, but most of them do.

Because the parsers return the parsed value of the argument. For example, if some (fake) argument has a raw value 0x4 which means F_WRITE, the output string will be "F_WRITE". However, if it has a value of 0x20, but the parsers don't know this value, an error will be returned. In this case, we can simply return the string value of the raw argument, which is "0x20"