Package vtrace :: Module snapshot :: Class TraceSnapshot

Class TraceSnapshot

           envi.memory.IMemory --+    
                                 |    
envi.registers.RegisterContext --+    
                                 |    
  envi.resolver.SymbolResolver --+    
                                 |    
                        object --+    
                                 |    
                             Trace --+
                                     |
                    object --+       |
                             |       |
            notifiers.Notifier --+   |
                                 |   |
         platforms.base.TracerBase --+
                                     |
                                    TraceSnapshot

A tracer snapshot is similar to a traditional "core file" except that you may also have memory only snapshots that are never written to disk.

TraceSnapshots allow you to take a picture of a process from a given point in it's execution and manipulate/test from there or save it to disk for later analysis...

Instance Methods

[hide private]

__init__(self, snapdict)
Hand in a register definition which consists of a list of (<name>, <width>) tuples.

source code

saveToFd(self, fd)
Save this snapshot to the given file like object for later reloading...

source code

saveToFile(self, filename)
Save a snapshot to file for later reading in...

source code

getMemoryMap(self, addr)
Return a tuple of mapva,size,perms,filename for the memory map which contains the specified address (or None).

source code

platformGetFds(self)
Return what getFds() wants for this particular platform

source code

getExe(self)
Get the full path to the main executable for this *attached* Trace

source code

getStackTrace(self)
Returns a list of (instruction pointer, stack frame) tuples.

source code

platformGetRegCtx(self, thrid)

source code

platformGetMaps(self)
Return a list of the memory maps where each element has the following structure: (address, length, perms, file="") NOTE: By Default this list is available as Trace.maps because the default implementation attempts to populate them on every break/stop/etc...

source code

platformGetThreads(self)
Return a dictionary of <threadid>:<tinfo> pairs where tinfo is either the stack top, or the teb for win32

source code

platformReadMemory(self, address, size)

source code

platformWriteMemory(self, address, bytes)

source code

platformDetach(self)
Actually perform the detach for this type

source code

platformParseBinary(self, *args)
Platforms must parse the given binary file and load any symbols into the internal SymbolResolver using self.addSymbol()

source code

cacheRegs(self, threadid)

source code

syncRegs(self)

source code

Inherited from Trace: addBreakByAddr, addBreakByExpr, addBreakpoint, addIgnoreSignal, allocateMemory, attach, buildNewTrace, call, delIgnoreSignal, deregisterNotifier, detach, disableAutoContinue, enableAutoContinue, execute, getAutoContinueList, getBreakpoint, getBreakpointByAddr, getBreakpointCode, getBreakpointEnabled, getBreakpoints, getCurrentBreakpoint, getCurrentSignal, getCurrentThread, getFds, getMemoryFault, getMemoryMaps, getMeta, getMode, getNormalizedLibNames, getNotifiers, getPid, getRegister, getRegisterContext, getStruct, getStructNames, getSymByAddr, getSymByName, getSymsForFile, getThreads, getVariable, getVariables, hasMeta, hex, injectThread, injectso, isAttached, isRemote, isRunning, isThreadSuspended, joinThread, kill, parseExpression, protectMemory, ps, readMemory, registerNotifier, release, removeBreakpoint, requireAttached, requireNotExited, requireNotRunning, resumeThread, run, runAgain, searchMemory, searchMemoryRange, searchSymbols, selectThread, sendBreak, setBreakpointCode, setBreakpointEnabled, setCurrentSignal, setMeta, setMode, setRegister, setVariable, stepi, suspendThread, writeMemory

Inherited from envi.memory.IMemory: addMemoryMap, getPointerSize, getSegmentInfo, isExecutable, isReadable, isShared, isValidPointer, isWriteable, parseOpcode, probeMemory, readMemValue, readMemoryFormat, writeMemoryFormat

Inherited from envi.registers.RegisterContext: addMetaRegister, getMetaRegInfo, getProgramCounter, getRegDef, getRegisterByName, getRegisterIndex, getRegisterInfo, getRegisterName, getRegisterNameIndexes, getRegisterNames, getRegisterSnap, getRegisterWidth, getRegisters, getStackCounter, isDirty, isMetaRegister, loadRegDef, loadRegMetas, reprRegister, setIsDirty, setProgramCounter, setRegisterByName, setRegisterIndexes, setRegisterInfo, setRegisterSnap, setRegisters, setStackCounter

Inherited from envi.registers.RegisterContext (private): _rctx_Export, _rctx_Import, _xlateToMetaReg, _xlateToNativeReg

Inherited from envi.resolver.SymbolResolver: addSymbol, delSymbol, getSymHint, getSymList

Inherited from platforms.base.TracerBase: __del__, __repr__, addLibraryBase, archAddWatchpoint, archCheckWatchpoints, archGetRegCtx, archGetStackTrace, archRemWatchpoint, checkBreakpoints, checkPageWatchpoints, checkWatchpoints, delLibraryBase, doStepLoop, fireNotifiers, fireTracerThread, getResolverForFile, initMode, nextBpId, normFileName, notify, platformAllocateMemory, platformAttach, platformCall, platformContinue, platformExec, platformGetMemFault, platformGetSignal, platformInjectSo, platformInjectThread, platformKill, platformOpenFile, platformProcessEvent, platformProtectMemory, platformPs, platformRelease, platformResumeThread, platformSelectThread, platformSetRegCtx, platformSetSignal, platformStepi, platformSuspendThread, platformWait, shouldRunAgain, steploop, wait

Inherited from platforms.base.TracerBase (private): _activateBreak, _cacheRegs, _checkForBreak, _cleanupBreakpoints, _cleanupResources, _doRun, _doWait, _findLibraryMaps, _fireBreakpoint, _fireExit, _fireExitThread, _fireSignal, _fireStep, _justAttached, _loadBinary, _loadBinaryNorm, _simpleCreateThreads, _syncRegs, _tellThreadExit, _throwdownBreaks

Inherited from notifiers.Notifier: handleEvent

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties

[hide private]

Inherited from object: __class__

Method Details

[hide private]

init(self, snapdict)
(Constructor)

source code

Hand in a register definition which consists of a list of (<name>, <width>) tuples.

Overrides: object.__init__: (inherited documentation)

getMemoryMap(self, addr)

source code

Return a tuple of mapva,size,perms,filename for the memory map which contains the specified address (or None).

Overrides: envi.memory.IMemory.getMemoryMap: (inherited documentation)

platformGetFds(self)

source code

Return what getFds() wants for this particular platform

Overrides: platforms.base.TracerBase.platformGetFds: (inherited documentation)

getExe(self)

source code

Get the full path to the main executable for this *attached* Trace

Overrides: platforms.base.TracerBase.getExe: (inherited documentation)

getStackTrace(self)

source code

Returns a list of (instruction pointer, stack frame) tuples. If stack tracing results in an error, the error entry will be (-1,-1). Otherwise most platforms end up with 0,0 as the top stack frame

Overrides: platforms.base.TracerBase.getStackTrace: (inherited documentation)

platformGetRegCtx(self, thrid)

source code

Overrides: platforms.base.TracerBase.platformGetRegCtx

platformGetMaps(self)

source code

Return a list of the memory maps where each element has the following structure: (address, length, perms, file="") NOTE: By Default this list is available as Trace.maps because the default implementation attempts to populate them on every break/stop/etc...

Overrides: platforms.base.TracerBase.platformGetMaps: (inherited documentation)

platformGetThreads(self)

source code

Return a dictionary of <threadid>:<tinfo> pairs where tinfo is either the stack top, or the teb for win32

Overrides: platforms.base.TracerBase.platformGetThreads: (inherited documentation)

Actually perform the detach for this type

Overrides: platforms.base.TracerBase.platformDetach: (inherited documentation)

platformParseBinary(self, *args)

source code

Platforms must parse the given binary file and load any symbols into the internal SymbolResolver using self.addSymbol()

Overrides: platforms.base.TracerBase.platformParseBinary: (inherited documentation)

Class TraceSnapshot

__init__(self, snapdict) (Constructor)

getMemoryMap(self, addr)

platformGetFds(self)

getExe(self)

getStackTrace(self)

platformGetRegCtx(self, thrid)

platformGetMaps(self)

platformGetThreads(self)

platformReadMemory(self, address, size)

platformWriteMemory(self, address, bytes)

platformDetach(self)

platformParseBinary(self, *args)

init(self, snapdict)
(Constructor)