Module ps_parsers :: Class register_metadata_parser
[show private | hide private]
[frames | no frames]

Class register_metadata_parser


Process Stalker can store per-node register meta-data. The purpose of this class is to alleviate the burden of handling register recordings by providing an abstraction layer.

Register recordings are stored in the following format:
   hit time:module name:breakpoint offset address:register name:register data location:register data
   0096e63c:msn.dll:022ede10:EAX::DEADBEEF
   0096e63c:msn.dll:022ede10:*EAX:heap:8405 0000 0000 0000 0000 0000 0100 0000

Method Summary
  __init__(self, base_address)
Initialize internal member variables.
  __module_test__(self)
Run a few basic tests to ensure the class is working.
Tuple get_recording_entry(self, index)
Get the recording entry at the specified index.
Integer num_entries(self)
Get the entry count for this recording.
  parse(self, filename)
Open and parse the specified register recording file.
Dictionary retrieve_register_metadata(self, register, address, module)
Get the recording entry at the specified index.

Method Details

__init__(self, base_address=0)
(Constructor)

Initialize internal member variables.
Parameters:
base_address - Optional address to re-base parsed xref offsets to.
           (type=DWORD)

__module_test__(self)

Run a few basic tests to ensure the class is working.

get_recording_entry(self, index)

Get the recording entry at the specified index.
Parameters:
index - Recording index
           (type=Integer)
Returns:
Time, module name, base, breakpoint offset address, register, register data location, register data
           (type=Tuple)
Raises:
psx - An exception is raised if the requested index is out of range.

num_entries(self)

Get the entry count for this recording.
Returns:
Recording count
           (type=Integer)

parse(self, filename)

Open and parse the specified register recording file. Register recordings are stored in the following format:
   hit time:module name:base addr:breakpoint offset address:register name:register data location:register data
   0096e63c:msn.dll:0001000:022ede10:EAX::DEADBEEF
   0096e63c:msn.dll:0001000:022ede10:*EAX:heap:8405 0000 0000 0000 0000 0000 0100 0000
Parameters:
filename - Filename
           (type=String)
Raises:
psx - An exception is raised if requested recording file can not be opened.

retrieve_register_metadata(self, register, address, module=0)

Get the recording entry at the specified index.
Parameters:
register - One of EAX, EBX, ECX, EDX, ESI, EDI, EBP
           (type=String)
address - Node address to retrieve register metadata for.
           (type=DWORD)
module - Module name
           (type=String)
Returns:
register{value, single_location, single_data, double_location, double_data} or 'False' if not found.
           (type=Dictionary)

To Do: Uncomment check for 'double_data' when double derefencing support is added to process stalker.


Generated by Epydoc 2.1 on Tue Jul 05 12:05:31 2005 http://epydoc.sf.net