The Volatility Framework
volatility.dwarf.DWARFParser Class Reference

A parser for DWARF files. More...

Inheritance diagram for volatility.dwarf.DWARFParser:

Public Member Functions

def __init__
 
def resolve (self, memb)
 Lookup anonymous member and replace it with a well known one. More...
 
def resolve_refs (self)
 Replace references with types. More...
 
def deep_replace (self, t, search, repl)
 Recursively replace anonymous references. More...
 
def get_deepest (self, t)
 
def base_type_name (self, data)
 Replace references to base types. More...
 
def feed_line (self, line)
 Accepts another line from the input. More...
 
def process_statement (self, kind, level, data, statement_id)
 Process a single parsed statement. More...
 
def process_variable (self, data)
 Process a local variable. More...
 
def finalize (self)
 Finalize the output. More...
 
def print_output (self)
 

Public Attributes

 current_level
 
 name_stack
 
 id_to_name
 
 all_vtypes
 
 vtypes
 
 enums
 
 all_vars
 
 vars
 
 all_local_vars
 
 local_vars
 
 anons
 
 base
 

Static Public Attributes

tuple dwarf_header_regex
 
tuple dwarf_key_val_regex
 
tuple dwarf_header_regex2 = re.compile(r'<(?P<level>\d+)><(?P<statement_id>0x[0-9a-fA-F]+([+]0x[0-9a-fA-F]+)?)><(?P<kind>\w+)>')
 
dictionary sz2tp = {8: 'long long', 4: 'int', 2: 'short', 1: 'char'}
 
dictionary tp2vol
 

Detailed Description

A parser for DWARF files.

Member Function Documentation

def volatility.dwarf.DWARFParser.base_type_name (   self,
  data 
)

Replace references to base types.

def volatility.dwarf.DWARFParser.deep_replace (   self,
  t,
  search,
  repl 
)

Recursively replace anonymous references.

def volatility.dwarf.DWARFParser.feed_line (   self,
  line 
)

Accepts another line from the input.

A DWARF line looks like: <2><1442><DW_TAG_member> DW_AT_name<fs> ...

The header is level, statement_id, and kind followed by key value pairs.

def volatility.dwarf.DWARFParser.finalize (   self)

Finalize the output.

def volatility.dwarf.DWARFParser.process_statement (   self,
  kind,
  level,
  data,
  statement_id 
)

Process a single parsed statement.

def volatility.dwarf.DWARFParser.process_variable (   self,
  data 
)

Process a local variable.

def volatility.dwarf.DWARFParser.resolve (   self,
  memb 
)

Lookup anonymous member and replace it with a well known one.

def volatility.dwarf.DWARFParser.resolve_refs (   self)

Replace references with types.

Member Data Documentation

tuple volatility.dwarf.DWARFParser.dwarf_header_regex
static
Initial value:
1 = re.compile(
2  r'<(?P<level>\d+)><(?P<statement_id>[0-9+]+)><(?P<kind>\w+)>')
tuple volatility.dwarf.DWARFParser.dwarf_key_val_regex
static
Initial value:
1 = re.compile(
2  '\s*(?P<keyname>\w+)<(?P<val>[^>]*)>')
dictionary volatility.dwarf.DWARFParser.tp2vol
static
Initial value:
1 = {
2  '_Bool': 'unsigned char',
3  'char': 'char',
4  'float': 'float',
5  'double': 'double',
6  'long double': 'double',
7  'int': 'int',
8  'long int': 'long',
9  'long long int': 'long long',
10  'long long unsigned int': 'unsigned long long',
11  'long unsigned int': 'unsigned long',
12  'short int': 'short',
13  'short unsigned int': 'unsigned short',
14  'signed char': 'signed char',
15  'unsigned char': 'unsigned char',
16  'unsigned int': 'unsigned int',
17  'sizetype' : 'unsigned long',
18  }

The documentation for this class was generated from the following file: