volatility.dwarf.DWARFParser Class Reference

A parser for DWARF files. More...

Inheritance diagram for volatility.dwarf.DWARFParser:

Public Member Functions
def	__init__
def	resolve (self, memb)
	Lookup anonymous member and replace it with a well known one. More...
def	resolve_refs (self)
	Replace references with types. More...
def	deep_replace (self, t, search, repl)
	Recursively replace anonymous references. More...
def	get_deepest (self, t)
def	base_type_name (self, data)
	Replace references to base types. More...
def	feed_line (self, line)
	Accepts another line from the input. More...
def	process_statement (self, kind, level, data, statement_id)
	Process a single parsed statement. More...
def	process_variable (self, data)
	Process a local variable. More...
def	finalize (self)
	Finalize the output. More...
def	print_output (self)

Public Attributes
	current_level
	name_stack
	id_to_name
	all_vtypes
	vtypes
	enums
	all_vars
	vars
	all_local_vars
	local_vars
	anons
	base

Static Public Attributes
tuple	dwarf_header_regex
tuple	dwarf_key_val_regex
tuple	dwarf_header_regex2 = re.compile(r'<(?P<level>\d+)><(?P<statement_id>0x[0-9a-fA-F]+([+]0x[0-9a-fA-F]+)?)><(?P<kind>\w+)>')
dictionary	sz2tp = {8: 'long long', 4: 'int', 2: 'short', 1: 'char'}
dictionary	tp2vol

Detailed Description

A parser for DWARF files.

Member Function Documentation

def volatility.dwarf.DWARFParser.base_type_name	(		self,
			data
	)

Replace references to base types.

def volatility.dwarf.DWARFParser.deep_replace	(		self,
			t,
			search,
			repl
	)

Recursively replace anonymous references.

def volatility.dwarf.DWARFParser.feed_line	(		self,
			line
	)

Accepts another line from the input.

A DWARF line looks like: <2><1442><DW_TAG_member> DW_AT_name<fs> ...

The header is level, statement_id, and kind followed by key value pairs.

def volatility.dwarf.DWARFParser.finalize

(

self

)

Finalize the output.

def volatility.dwarf.DWARFParser.process_statement	(		self,
			kind,
			level,
			data,
			statement_id
	)

Process a single parsed statement.

def volatility.dwarf.DWARFParser.process_variable	(		self,
			data
	)

Process a local variable.

def volatility.dwarf.DWARFParser.resolve	(		self,
			memb
	)

Lookup anonymous member and replace it with a well known one.

def volatility.dwarf.DWARFParser.resolve_refs

(

self

)

Replace references with types.

Member Data Documentation

tuple volatility.dwarf.DWARFParser.dwarf_header_regex

static

Initial value:

= re.compile(
        r'<(?P<level>\d+)><(?P<statement_id>[0-9+]+)><(?P<kind>\w+)>')

tuple volatility.dwarf.DWARFParser.dwarf_key_val_regex

static

Initial value:

= re.compile(
        '\s*(?P<keyname>\w+)<(?P<val>[^>]*)>')

dictionary volatility.dwarf.DWARFParser.tp2vol

static

Initial value:

= {
        '_Bool': 'unsigned char',
        'char': 'char',
        'float': 'float',
        'double': 'double',
        'long double': 'double',
        'int': 'int',
        'long int': 'long',
        'long long int': 'long long',
        'long long unsigned int': 'unsigned long long',
        'long unsigned int': 'unsigned long',
        'short int': 'short',
        'short unsigned int': 'unsigned short',
        'signed char': 'signed char',
        'unsigned char': 'unsigned char',
        'unsigned int': 'unsigned int',
        'sizetype' : 'unsigned long',
    }

---

The documentation for this class was generated from the following file:

• volatility/dwarf.py