| OLD | NEW |
| 1 #!/usr/bin/env python | 1 #!/usr/bin/env python |
| 2 # coding=utf-8 | 2 # coding=utf-8 |
| 3 # Copyright (c) 2012 The Chromium Authors. All rights reserved. | 3 # Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 4 # Use of this source code is governed by a BSD-style license that can be | 4 # Use of this source code is governed by a BSD-style license that can be |
| 5 # found in the LICENSE file. | 5 # found in the LICENSE file. |
| 6 | 6 |
| 7 """Traces an executable and its child processes and extract the files accessed | 7 """Traces an executable and its child processes and extract the files accessed |
| 8 by them. | 8 by them. |
| 9 | 9 |
| 10 The implementation uses OS-specific API. The native Kernel logger and the ETL | 10 The implementation uses OS-specific API. The native Kernel logger and the ETL |
| (...skipping 2438 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2449 return | 2449 return |
| 2450 # Override any stale file object | 2450 # Override any stale file object |
| 2451 proc.file_objects[file_object] = filepath | 2451 proc.file_objects[file_object] = filepath |
| 2452 | 2452 |
| 2453 def handle_FileIo_Rename(self, line): | 2453 def handle_FileIo_Rename(self, line): |
| 2454 # TODO(maruel): Handle? | 2454 # TODO(maruel): Handle? |
| 2455 pass | 2455 pass |
| 2456 | 2456 |
| 2457 def handle_Process_End(self, line): | 2457 def handle_Process_End(self, line): |
| 2458 pid = line[self.PID] | 2458 pid = line[self.PID] |
| 2459 if pid in self._process_lookup: | 2459 if self._process_lookup.get(pid): |
| 2460 logging.info('Terminated: %d' % pid) | 2460 logging.info('Terminated: %d' % pid) |
| 2461 self._process_lookup[pid] = None | 2461 self._process_lookup[pid] = None |
| 2462 else: | 2462 else: |
| 2463 logging.debug('Terminated: %d' % pid) | 2463 logging.debug('Terminated: %d' % pid) |
| 2464 | 2464 |
| 2465 def handle_Process_Start(self, line): | 2465 def handle_Process_Start(self, line): |
| 2466 """Handles a new child process started by PID.""" | 2466 """Handles a new child process started by PID.""" |
| 2467 #UNIQUE_PROCESS_KEY = self.USER_DATA | 2467 #UNIQUE_PROCESS_KEY = self.USER_DATA |
| 2468 PROCESS_ID = self.USER_DATA + 1 | 2468 PROCESS_ID = self.USER_DATA + 1 |
| 2469 #PARENT_PID = self.USER_DATA + 2 | 2469 #PARENT_PID = self.USER_DATA + 2 |
| (...skipping 14 matching lines...) Expand all Loading... |
| 2484 # Need to ignore processes we don't know about because the log is | 2484 # Need to ignore processes we don't know about because the log is |
| 2485 # system-wide. self._tracer_pid shall start only one process. | 2485 # system-wide. self._tracer_pid shall start only one process. |
| 2486 if self.root_process: | 2486 if self.root_process: |
| 2487 raise TracingFailure( | 2487 raise TracingFailure( |
| 2488 ( 'Parent process is _tracer_pid(%d) but root_process(%d) is ' | 2488 ( 'Parent process is _tracer_pid(%d) but root_process(%d) is ' |
| 2489 'already set') % (self._tracer_pid, self.root_process.pid), | 2489 'already set') % (self._tracer_pid, self.root_process.pid), |
| 2490 None, None, None) | 2490 None, None, None) |
| 2491 proc = self.Process(self.blacklist, pid, None) | 2491 proc = self.Process(self.blacklist, pid, None) |
| 2492 self.root_process = proc | 2492 self.root_process = proc |
| 2493 ppid = None | 2493 ppid = None |
| 2494 elif ppid in self._process_lookup: | 2494 elif self._process_lookup.get(ppid): |
| 2495 proc = self.Process(self.blacklist, pid, None) | 2495 proc = self.Process(self.blacklist, pid, None) |
| 2496 self._process_lookup[ppid].children.append(proc) | 2496 self._process_lookup[ppid].children.append(proc) |
| 2497 else: | 2497 else: |
| 2498 # Ignore | 2498 # Ignore |
| 2499 return | 2499 return |
| 2500 self._process_lookup[pid] = proc | 2500 self._process_lookup[pid] = proc |
| 2501 | 2501 |
| 2502 if (not line[IMAGE_FILE_NAME].startswith('"') or | 2502 if (not line[IMAGE_FILE_NAME].startswith('"') or |
| 2503 not line[IMAGE_FILE_NAME].endswith('"')): | 2503 not line[IMAGE_FILE_NAME].endswith('"')): |
| 2504 raise TracingFailure( | 2504 raise TracingFailure( |
| (...skipping 695 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 3200 return command(argv[1:]) | 3200 return command(argv[1:]) |
| 3201 except TracingFailure, e: | 3201 except TracingFailure, e: |
| 3202 sys.stderr.write('\nError: ') | 3202 sys.stderr.write('\nError: ') |
| 3203 sys.stderr.write(str(e)) | 3203 sys.stderr.write(str(e)) |
| 3204 sys.stderr.write('\n') | 3204 sys.stderr.write('\n') |
| 3205 return 1 | 3205 return 1 |
| 3206 | 3206 |
| 3207 | 3207 |
| 3208 if __name__ == '__main__': | 3208 if __name__ == '__main__': |
| 3209 sys.exit(main(sys.argv[1:])) | 3209 sys.exit(main(sys.argv[1:])) |
| OLD | NEW |