Package rekall :: Package plugins :: Package overlays :: Package linux :: Module dwarfdump :: Class DWARFParser

[frames] | no frames]

Class DWARFParser

source code

A parser for DWARF files.

Instance Methods

__init__(self, data=None)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

resolve(self, memb)
Lookup anonymous member and replace it with a well known one.

source code

resolve_refs(self)
Replace references with types.

source code

deep_replace(self, t, search, repl)
Recursively replace anonymous references.

source code

get_deepest(self, t)

source code

base_type_name(self, data)
Replace references to base types.

source code

feed_line(self, line)
Accepts another line from the input.

source code

process_statement(self, kind, level, data, statement_id)
Process a single parsed statement.

source code

process_variable(self, data)
Process a local variable.

source code

finalize(self)
Finalize the output.

source code

print_output(self)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables
	dwarf_header_regex = `re.compile(r'<(?P<level>\d+)><(?P<stateme...`
	dwarf_key_val_regex = `re.compile(r'\s*(?P<keyname>\w+)<(?P<val...`
	dwarf_header_regex2 = `re.compile(r'<(?P<level>\d+)><(?P<statem...`
	sz2tp = `{1: 'char', 2: 'short', 4: 'int', 8: 'long long'}`
	tp2vol = `{'_Bool': 'unsigned char', 'char': 'char', 'double': ...`

Properties
Inherited from `object`: `__class__`

Method Details

init(self, data=None)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

feed_line(self, line)

source code

Accepts another line from the input.

A DWARF line looks like: <2><1442><DW_TAG_member> DW_AT_name<fs> ...

The header is level, statement_id, and kind followed by key value pairs.

Class Variable Details

dwarf_header_regex

Value:

re.compile(r'<(?P<level>\d+)><(?P<statement_id>[0-9\+]+)><(?P<kind>\w+
)>')

dwarf_key_val_regex

Value:

re.compile(r'\s*(?P<keyname>\w+)<(?P<val>[^>]*)>')

dwarf_header_regex2

Value:

re.compile(r'<(?P<level>\d+)><(?P<statement_id>0x[0-9a-fA-F]+(\+0x[0-9
a-fA-F]+)?)><(?P<kind>\w+)>')

tp2vol

Value:

{'_Bool': 'unsigned char',
 'char': 'char',
 'double': 'double',
 'float': 'float',
 'int': 'int',
 'long double': 'double',
 'long int': 'long',
 'long long int': 'long long',
...

Class DWARFParser

__init__(self, data=None) (Constructor)

feed_line(self, line)

dwarf_header_regex

dwarf_key_val_regex

dwarf_header_regex2

tp2vol

init(self, data=None)
(Constructor)