IMG: Image Object

Typedefs
typedef VOID(*	LEVEL_PINCLIENT::IMAGECALLBACK )(IMG, VOID *)
Enumerations
enum	LEVEL_CORE::IMG_TYPE {   IMG_TYPE_INVALID,   LEVEL_CORE::IMG_TYPE_STATIC,   LEVEL_CORE::IMG_TYPE_SHARED,   LEVEL_CORE::IMG_TYPE_SHAREDLIB,   LEVEL_CORE::IMG_TYPE_RELOCATABLE,   IMG_TYPE_LAST }
Functions
IMG	LEVEL_PINCLIENT::IMG_Next (IMG x)
IMG	LEVEL_PINCLIENT::IMG_Prev (IMG x)
IMG	LEVEL_PINCLIENT::IMG_Invalid ()
BOOL	LEVEL_PINCLIENT::IMG_Valid (IMG x)
SEC	LEVEL_PINCLIENT::IMG_SecHead (IMG x)
SEC	LEVEL_PINCLIENT::IMG_SecTail (IMG x)
SYM	LEVEL_PINCLIENT::IMG_RegsymHead (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_Entry (IMG x)
const string &	LEVEL_PINCLIENT::IMG_Name (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_Gp (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_LoadOffset (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_LowAddress (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_HighAddress (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_StartAddress (IMG x)
USIZE	LEVEL_PINCLIENT::IMG_SizeMapped (IMG x)
IMG_TYPE	LEVEL_PINCLIENT::IMG_Type (IMG x)
UINT32	LEVEL_PINCLIENT::IMG_Id (IMG x)
IMG	LEVEL_PINCLIENT::IMG_FindImgById (UINT32 id)
VOID	LEVEL_PINCLIENT::IMG_AddInstrumentFunction (IMAGECALLBACK fun, VOID *v)
VOID	LEVEL_PINCLIENT::IMG_AddUnloadFunction (IMAGECALLBACK fun, VOID *v)
IMG	LEVEL_PINCLIENT::IMG_Open (const string &filename)
VOID	LEVEL_PINCLIENT::IMG_Close (IMG img)
IMG	LEVEL_PINCLIENT::APP_ImgHead ()
IMG	LEVEL_PINCLIENT::APP_ImgTail ()

---

Detailed Description

An IMG represents all the data structures corresponding to a binary (executable). Can be accessed at instrumentation time and analysis time. Note: Shared libraries are also represented by the IMG abstraction. Moreover, the IMG objects are created in a lazy fashion. Only if a shared library is loaded and IMG is created. Over the lifetime of a process the number IMG objects created may hence increase.

Example tools:

Detecting the Loading and Unloading of Images (Image Instrumentation)

Iteration idioms:

    // Visit every loaded image
    for( IMG img= APP_ImgHead(); IMG_Valid(img); img = IMG_Next(img) )

---

Typedef Documentation

typedef VOID(* LEVEL_PINCLIENT::IMAGECALLBACK)(IMG, VOID *)

Type of function to be called when an image is loaded

---

Enumeration Type Documentation

enum LEVEL_CORE::IMG_TYPE

Enumerator: IMG_TYPE_STATIC  Main image, linked with -static. IMG_TYPE_SHARED  Main image, linked against shared libraries. IMG_TYPE_SHAREDLIB  Shared library. IMG_TYPE_RELOCATABLE  Relocatble object (.o file).

---

Function Documentation

IMG LEVEL_PINCLIENT::APP_ImgHead (   )

Returns: The first image loaded into memory

IMG LEVEL_PINCLIENT::APP_ImgTail (   )

Returns: The last image loaded into memory

VOID LEVEL_PINCLIENT::IMG_AddInstrumentFunction (  IMAGECALLBACK  fun, VOID *  v )

Use this to register a call back to catch the loading of an image Parameters: fun  Instrumentation function for images, it is passed an image and v v  the value of to pass to fun when an image is loaded

VOID LEVEL_PINCLIENT::IMG_AddUnloadFunction (  IMAGECALLBACK  fun, VOID *  v )

Register fun as a call back to be used when an image is unloaded. This is not an instrumentation function--it doesn't make sense to instrument a function when it removed from memory. Parameters: fun  passed an image and v when an image is unloaded v  the value to pass to fun when an image is unloaded

VOID LEVEL_PINCLIENT::IMG_Close (  IMG  img  )

Close the image that was opened

ADDRINT LEVEL_PINCLIENT::IMG_Entry (  IMG  x  )

Returns: Address of first instruction executed when image is loaded

IMG LEVEL_PINCLIENT::IMG_FindImgById (  UINT32  id  )

Find image by Id Returns: IMG object, valid or invalid

ADDRINT LEVEL_PINCLIENT::IMG_Gp (  IMG  x  )

Not implemented yet. Returns: Global pointer (GP) of image, if a GP is used to address global data

ADDRINT LEVEL_PINCLIENT::IMG_HighAddress (  IMG  x  )

Returns: the highest virtual address of the image in the memory

UINT32 LEVEL_PINCLIENT::IMG_Id (  IMG  x  )

Unique Id If an image is unloaded, the id is not reused for a different image. If an image is unloaded and the same one is loaded back, the id is different Returns: unique id for image

IMG LEVEL_PINCLIENT::IMG_Invalid (   )

Returns: Used to indicate no image

ADDRINT LEVEL_PINCLIENT::IMG_LoadOffset (  IMG  x  )

Returns: Offset between loaded address and linked address of image

ADDRINT LEVEL_PINCLIENT::IMG_LowAddress (  IMG  x  )

Returns: the lowest virtual address of the image in the memory

const string& LEVEL_PINCLIENT::IMG_Name (  IMG  x  )

Returns: Name of image

IMG LEVEL_PINCLIENT::IMG_Next (  IMG  x  )

Returns: Of the list of currently loaded images in memory it returns the image loaded after image x, or IMG_Invalid() if x is the last image

IMG LEVEL_PINCLIENT::IMG_Open (  const string &  filename  )

Allows one to open and image and browse it statically. There can only be one image opened at a time. Returns IMG_INVALID() for image can not be opened.

IMG LEVEL_PINCLIENT::IMG_Prev (  IMG  x  )

Returns: Of the list of currently loaded images in memory it returns the image loaded prior to image x, or IMG_Invalid() if x is the first image

SYM LEVEL_PINCLIENT::IMG_RegsymHead (  IMG  x  )

Returns: First regular symbol in image

SEC LEVEL_PINCLIENT::IMG_SecHead (  IMG  x  )

Returns: First section in image

SEC LEVEL_PINCLIENT::IMG_SecTail (  IMG  x  )

Returns: Last section in image

USIZE LEVEL_PINCLIENT::IMG_SizeMapped (  IMG  x  )

Returns: the size of the image mapped

ADDRINT LEVEL_PINCLIENT::IMG_StartAddress (  IMG  x  )

Returns: the starting virtual address that the image is mapped to

IMG_TYPE LEVEL_PINCLIENT::IMG_Type (  IMG  x  )

Returns: Image type

BOOL LEVEL_PINCLIENT::IMG_Valid (  IMG  x  )

Returns: True if x is not IMG_Invalid()

---