Merge pull request #19 from matan1008/feature/dyld-more-traces

Feature/dyld more traces

.github/workflows/python-publish.yml

@@ -21,11 +21,11 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install setuptools wheel twine
+        pip install setuptools wheel twine build
     - name: Build and publish
       env:
         TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
         TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
       run: |
-        python setup.py sdist bdist_wheel
+        python -m build
         twine upload dist/*

pykdebugparser/trace.codes

@@ -2352,9 +2352,19 @@
 0x1f050030	DYLD_uuid_shared_cache_32_a
 0x1f050034	DYLD_uuid_shared_cache_32_b
 0x1f050038	DYLD_uuid_shared_cache_32_c
+0x1f070000	DBG_DYLD_TIMING_STATIC_INITIALIZER
 0x1f070004	DBG_DYLD_TIMING_LAUNCH_EXECUTABLE
 0x1f070008	DBG_DYLD_TIMING_MAP_IMAGE
+0x1f07000c	DBG_DYLD_TIMING_APPLY_FIXUPS
+0x1f070010	DBG_DYLD_TIMING_ATTACH_CODESIGNATURE
+0x1f070014	DBG_DYLD_TIMING_BUILD_CLOSURE
 0x1f070018	DBG_DYLD_TIMING_FUNC_FOR_ADD_IMAGE
+0x1f07001c	DBG_DYLD_TIMING_FUNC_FOR_REMOVE_IMAGE
+0x1f070020	DBG_DYLD_TIMING_OBJC_INIT
+0x1f070024	DBG_DYLD_TIMING_OBJC_MAP
+0x1f070028	DBG_DYLD_TIMING_APPLY_INTERPOSING
+0x1f07002c	DBG_DYLD_GDB_IMAGE_NOTIFIER
+0x1f070030	DBG_DYLD_REMOTE_IMAGE_NOTIFIER
 0x1f070034	DBG_DYLD_TIMING_BOOTSTRAP_START
 0x1f080000	DBG_DYLD_TIMING_DLOPEN
 0x1f080004	DBG_DYLD_TIMING_DLOPEN_PREFLIGHT

pykdebugparser/trace_handlers/dyld.py

@@ -39,6 +39,27 @@ def __str__(self):
         return f'DYLD_uuid_map_b, fid_objno: {self.fid_objno}, fid_generation: {hex(self.fid_generation)}'
 
 
+@dataclass
+class DyldUuidUnmapA:
+    ktraces: List
+    uuid: UUID
+    load_addr: int
+    fsid: int
+
+    def __str__(self):
+        return f'DYLD_uuid_unmap_a, uuid: "{self.uuid}", load_addr: {hex(self.load_addr)}, fsid: {hex(self.fsid)}'
+
+
+@dataclass
+class DyldUuidUnmapB:
+    ktraces: List
+    fid_objno: int
+    fid_generation: int
+
+    def __str__(self):
+        return f'DYLD_uuid_unmap_b, fid_objno: {self.fid_objno}, fid_generation: {hex(self.fid_generation)}'
+
+
 @dataclass
 class DyldUuidSharedCacheA:
     ktraces: List
@@ -71,6 +92,15 @@ def __str__(self):
         return f'DBG_DYLD_TIMING_LAUNCH_EXECUTABLE, main_executable_mh: {hex(self.main_executable_mh)}'
 
 
+@dataclass
+class DyldMapImage:
+    ktraces: List
+    path: str
+
+    def __str__(self):
+        return f'DBG_DYLD_TIMING_MAP_IMAGE, path: {self.path}'
+
+
 @dataclass
 class DyldFuncForAddImage:
     ktraces: List
@@ -151,6 +181,16 @@ def handle_uuid_map_b(parser, events):
     return DyldUuidMapB(events, arg & 0xffffffff, arg >> 32)
 
 
+def handle_uuid_unmap_a(parser, events):
+    args = events[0].values
+    return DyldUuidUnmapA(events, UUID(bytes=events[0].data[:16]), args[2], args[3])
+
+
+def handle_uuid_unmap_b(parser, events):
+    arg = events[0].values[0]
+    return DyldUuidUnmapB(events, arg & 0xffffffff, arg >> 32)
+
+
 def handle_uuid_shared_cache_a(parser, events):
     args = events[0].values
     return DyldUuidSharedCacheA(events, UUID(bytes=events[0].data[:16]), args[2], args[3])
@@ -169,6 +209,12 @@ def handle_timing_launch_executable(parser, events):
     return DyldLaunchExecutable(events, events[0].values[1], map_a)
 
 
+def handle_timing_map_image(parser, events):
+    args = events[0].values
+    path = parser.global_strings[args[1]] if args[1] else ''
+    return DyldMapImage(events, path)
+
+
 def handle_timing_func_for_add_image(parser, events):
     args = events[0].values
     return DyldFuncForAddImage(events, args[1], args[2])
@@ -204,9 +250,12 @@ def handle_timing_dladdr(parser, events):
 handlers = {
     'DYLD_uuid_map_a': handle_uuid_map_a,
     'DYLD_uuid_map_b': handle_uuid_map_b,
+    'DYLD_uuid_unmap_a': handle_uuid_unmap_a,
+    'DYLD_uuid_unmap_b': handle_uuid_unmap_b,
     'DYLD_uuid_shared_cache_a': handle_uuid_shared_cache_a,
     'DYLD_uuid_shared_cache_b': handle_uuid_shared_cache_b,
     'DBG_DYLD_TIMING_LAUNCH_EXECUTABLE': handle_timing_launch_executable,
+    'DBG_DYLD_TIMING_MAP_IMAGE': handle_timing_map_image,
     'DBG_DYLD_TIMING_FUNC_FOR_ADD_IMAGE': handle_timing_func_for_add_image,
     'DBG_DYLD_TIMING_BOOTSTRAP_START': handle_timing_bootstrap_start,
     'DBG_DYLD_TIMING_DLOPEN': handle_timing_dlopen,

pyproject.toml

@@ -0,0 +1,48 @@
+[build-system]
+requires = ["setuptools", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pykdebugparser"
+version = "1.2.1"
+description = "Python parser for kdebug events"
+readme.file = "README.md"
+readme.content-type = "text/markdown"
+requires-python = ">=3.7"
+license = {file = "LICENSE"}
+authors = [
+  {email = "[email protected]"},
+  {name = "Matan Perelman"},
+]
+classifiers = [
+    "Programming Language :: Python :: 3.7",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+]
+dependencies = [
+    "construct",
+    "pygments",
+    "click",
+    "termcolor",
+]
+
+[project.urls]
+Homepage = "https://github.com/matan1008/pykdebugparser"
+Source = "https://github.com/matan1008/pykdebugparser"
+
+[project.optional-dependencies]
+testing = ["pytest"]
+
+[project.scripts]
+pykdebugparser = "pykdebugparser.__main__:cli"
+
+
+[tool.setuptools.packages]
+find = {}
+
+[tool.setuptools.package-data]
+pykdebugparser = ["*.txt", "*.TXT", "*.codes"]
+
+[tool.distutils.bdist_wheel]
+universal = true