OLD | NEW |
1 #!/usr/bin/env python | 1 #!/usr/bin/env python |
2 # coding=utf-8 | 2 # coding=utf-8 |
3 # Copyright (c) 2012 The Chromium Authors. All rights reserved. | 3 # Copyright (c) 2012 The Chromium Authors. All rights reserved. |
4 # Use of this source code is governed by a BSD-style license that can be | 4 # Use of this source code is governed by a BSD-style license that can be |
5 # found in the LICENSE file. | 5 # found in the LICENSE file. |
6 | 6 |
7 """Traces an executable and its child processes and extract the files accessed | 7 """Traces an executable and its child processes and extract the files accessed |
8 by them. | 8 by them. |
9 | 9 |
10 The implementation uses OS-specific API. The native Kernel logger and the ETL | 10 The implementation uses OS-specific API. The native Kernel logger and the ETL |
(...skipping 2438 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2449 return | 2449 return |
2450 # Override any stale file object | 2450 # Override any stale file object |
2451 proc.file_objects[file_object] = filepath | 2451 proc.file_objects[file_object] = filepath |
2452 | 2452 |
2453 def handle_FileIo_Rename(self, line): | 2453 def handle_FileIo_Rename(self, line): |
2454 # TODO(maruel): Handle? | 2454 # TODO(maruel): Handle? |
2455 pass | 2455 pass |
2456 | 2456 |
2457 def handle_Process_End(self, line): | 2457 def handle_Process_End(self, line): |
2458 pid = line[self.PID] | 2458 pid = line[self.PID] |
2459 if pid in self._process_lookup: | 2459 if self._process_lookup.get(pid): |
2460 logging.info('Terminated: %d' % pid) | 2460 logging.info('Terminated: %d' % pid) |
2461 self._process_lookup[pid] = None | 2461 self._process_lookup[pid] = None |
2462 else: | 2462 else: |
2463 logging.debug('Terminated: %d' % pid) | 2463 logging.debug('Terminated: %d' % pid) |
2464 | 2464 |
2465 def handle_Process_Start(self, line): | 2465 def handle_Process_Start(self, line): |
2466 """Handles a new child process started by PID.""" | 2466 """Handles a new child process started by PID.""" |
2467 #UNIQUE_PROCESS_KEY = self.USER_DATA | 2467 #UNIQUE_PROCESS_KEY = self.USER_DATA |
2468 PROCESS_ID = self.USER_DATA + 1 | 2468 PROCESS_ID = self.USER_DATA + 1 |
2469 #PARENT_PID = self.USER_DATA + 2 | 2469 #PARENT_PID = self.USER_DATA + 2 |
(...skipping 14 matching lines...) Expand all Loading... |
2484 # Need to ignore processes we don't know about because the log is | 2484 # Need to ignore processes we don't know about because the log is |
2485 # system-wide. self._tracer_pid shall start only one process. | 2485 # system-wide. self._tracer_pid shall start only one process. |
2486 if self.root_process: | 2486 if self.root_process: |
2487 raise TracingFailure( | 2487 raise TracingFailure( |
2488 ( 'Parent process is _tracer_pid(%d) but root_process(%d) is ' | 2488 ( 'Parent process is _tracer_pid(%d) but root_process(%d) is ' |
2489 'already set') % (self._tracer_pid, self.root_process.pid), | 2489 'already set') % (self._tracer_pid, self.root_process.pid), |
2490 None, None, None) | 2490 None, None, None) |
2491 proc = self.Process(self.blacklist, pid, None) | 2491 proc = self.Process(self.blacklist, pid, None) |
2492 self.root_process = proc | 2492 self.root_process = proc |
2493 ppid = None | 2493 ppid = None |
2494 elif ppid in self._process_lookup: | 2494 elif self._process_lookup.get(ppid): |
2495 proc = self.Process(self.blacklist, pid, None) | 2495 proc = self.Process(self.blacklist, pid, None) |
2496 self._process_lookup[ppid].children.append(proc) | 2496 self._process_lookup[ppid].children.append(proc) |
2497 else: | 2497 else: |
2498 # Ignore | 2498 # Ignore |
2499 return | 2499 return |
2500 self._process_lookup[pid] = proc | 2500 self._process_lookup[pid] = proc |
2501 | 2501 |
2502 if (not line[IMAGE_FILE_NAME].startswith('"') or | 2502 if (not line[IMAGE_FILE_NAME].startswith('"') or |
2503 not line[IMAGE_FILE_NAME].endswith('"')): | 2503 not line[IMAGE_FILE_NAME].endswith('"')): |
2504 raise TracingFailure( | 2504 raise TracingFailure( |
(...skipping 695 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3200 return command(argv[1:]) | 3200 return command(argv[1:]) |
3201 except TracingFailure, e: | 3201 except TracingFailure, e: |
3202 sys.stderr.write('\nError: ') | 3202 sys.stderr.write('\nError: ') |
3203 sys.stderr.write(str(e)) | 3203 sys.stderr.write(str(e)) |
3204 sys.stderr.write('\n') | 3204 sys.stderr.write('\n') |
3205 return 1 | 3205 return 1 |
3206 | 3206 |
3207 | 3207 |
3208 if __name__ == '__main__': | 3208 if __name__ == '__main__': |
3209 sys.exit(main(sys.argv[1:])) | 3209 sys.exit(main(sys.argv[1:])) |
OLD | NEW |