IMG: Image Object

Typedefs
typedef VOID(*	LEVEL_PINCLIENT::IMAGECALLBACK )(IMG, VOID *)
Enumerations
enum	LEVEL_CORE::IMG_TYPE {   IMG_TYPE_INVALID,   LEVEL_CORE::IMG_TYPE_STATIC,   LEVEL_CORE::IMG_TYPE_SHARED,   LEVEL_CORE::IMG_TYPE_SHAREDLIB,   LEVEL_CORE::IMG_TYPE_RELOCATABLE,   IMG_TYPE_LAST }
Functions
IMG	LEVEL_PINCLIENT::IMG_Next (IMG x)
IMG	LEVEL_PINCLIENT::IMG_Prev (IMG x)
IMG	LEVEL_PINCLIENT::IMG_Invalid ()
BOOL	LEVEL_PINCLIENT::IMG_Valid (IMG x)
SEC	LEVEL_PINCLIENT::IMG_SecHead (IMG x)
SEC	LEVEL_PINCLIENT::IMG_SecTail (IMG x)
SYM	LEVEL_PINCLIENT::IMG_RegsymHead (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_Entry (IMG x)
const string &	LEVEL_PINCLIENT::IMG_Name (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_Gp (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_LoadOffset (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_LowAddress (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_HighAddress (IMG x)
ADDRINT	LEVEL_PINCLIENT::IMG_StartAddress (IMG x)
USIZE	LEVEL_PINCLIENT::IMG_SizeMapped (IMG x)
IMG_TYPE	LEVEL_PINCLIENT::IMG_Type (IMG x)
BOOL	LEVEL_PINCLIENT::IMG_IsMainExecutable (IMG x)
UINT32	LEVEL_PINCLIENT::IMG_Id (IMG x)
IMG	LEVEL_PINCLIENT::IMG_FindImgById (UINT32 id)
IMG	LEVEL_PINCLIENT::IMG_FindByAddress (ADDRINT address)
VOID	LEVEL_PINCLIENT::IMG_AddInstrumentFunction (IMAGECALLBACK fun, VOID *v)
VOID	LEVEL_PINCLIENT::IMG_AddUnloadFunction (IMAGECALLBACK fun, VOID *v)
IMG	LEVEL_PINCLIENT::IMG_Open (const string &filename)
VOID	LEVEL_PINCLIENT::IMG_Close (IMG img)
IMG	LEVEL_PINCLIENT::APP_ImgHead ()
IMG	LEVEL_PINCLIENT::APP_ImgTail ()

---

Detailed Description

An IMG represents all the data structures corresponding to a binary (executable). Can be accessed at instrumentation time and analysis time. Note: Shared libraries are also represented by the IMG abstraction. Moreover, the IMG objects are created in a lazy fashion. Only if a shared library is loaded and IMG is created. Over the lifetime of a process the number IMG objects created may hence increase.

Example tools:

Detecting the Loading and Unloading of Images (Image Instrumentation)

Iteration idioms:

    // Visit every loaded image
    for( IMG img= APP_ImgHead(); IMG_Valid(img); img = IMG_Next(img) )

---

Typedef Documentation

typedef VOID(* LEVEL_PINCLIENT::IMAGECALLBACK)(IMG, VOID *)

Type of function to be called when an image is loaded

---

Enumeration Type Documentation

enum LEVEL_CORE::IMG_TYPE

Enumerator: IMG_TYPE_STATIC  Main image, linked with -static. IMG_TYPE_SHARED  Main image, linked against shared libraries. IMG_TYPE_SHAREDLIB  Shared library. IMG_TYPE_RELOCATABLE  Relocatble object (.o file).

---

Function Documentation

IMG LEVEL_PINCLIENT::APP_ImgHead (   )

Returns: The first image loaded into memory Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

IMG LEVEL_PINCLIENT::APP_ImgTail (   )

Returns: The last image loaded into memory Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

VOID LEVEL_PINCLIENT::IMG_AddInstrumentFunction (  IMAGECALLBACK  fun, VOID *  v )

Use this to register a call back to catch the loading of an image Parameters: fun  Instrumentation function for images, it is passed an image and v v  the value of to pass to fun when an image is loaded Availability: Mode: JIT O/S: Linux, Windows & MacOS CPU: All

VOID LEVEL_PINCLIENT::IMG_AddUnloadFunction (  IMAGECALLBACK  fun, VOID *  v )

Register fun as a call back to be used when an image is unloaded. This is not an instrumentation function--it doesn't make sense to instrument a function when it removed from memory. Parameters: fun  passed an image and v when an image is unloaded v  the value to pass to fun when an image is unloaded Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

VOID LEVEL_PINCLIENT::IMG_Close (  IMG  img  )

Close the image that was opened

ADDRINT LEVEL_PINCLIENT::IMG_Entry (  IMG  x  )

Returns: Address of first instruction executed when image is loaded Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

IMG LEVEL_PINCLIENT::IMG_FindByAddress (  ADDRINT  address  )

Find image by address Returns: IMG object, valid or invalid Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

IMG LEVEL_PINCLIENT::IMG_FindImgById (  UINT32  id  )

Find image by Id Returns: IMG object, valid or invalid Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

ADDRINT LEVEL_PINCLIENT::IMG_Gp (  IMG  x  )

Returns: Global pointer (GP) of image, if a GP is used to address global data Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

ADDRINT LEVEL_PINCLIENT::IMG_HighAddress (  IMG  x  )

Returns: the highest virtual address of the image in the memory Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

UINT32 LEVEL_PINCLIENT::IMG_Id (  IMG  x  )

Unique Id If an image is unloaded, the id is not reused for a different image. If an image is unloaded and the same one is loaded back, the id is different Returns: unique id for image Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

IMG LEVEL_PINCLIENT::IMG_Invalid (   )

Returns: Used to indicate no image Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

BOOL LEVEL_PINCLIENT::IMG_IsMainExecutable (  IMG  x  )

Returns: TRUE if this is the main executable of an application Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

ADDRINT LEVEL_PINCLIENT::IMG_LoadOffset (  IMG  x  )

Returns: Offset between loaded address and linked address of image Availability: Mode: JIT & Probe O/S: Linux CPU: IA-64 architecture

ADDRINT LEVEL_PINCLIENT::IMG_LowAddress (  IMG  x  )

Returns: the lowest virtual address of the image in the memory Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

const string& LEVEL_PINCLIENT::IMG_Name (  IMG  x  )

Returns: Name of image, Image names are encoded in UTF8 (a superset of ASCII), this is supported for Linux (only for locales encoded in UTF8) and Windows Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

IMG LEVEL_PINCLIENT::IMG_Next (  IMG  x  )

Returns: Of the list of currently loaded images in memory it returns the image loaded after image x, or IMG_Invalid() if x is the last image Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

IMG LEVEL_PINCLIENT::IMG_Open (  const string &  filename  )

Allows one to open and image and browse it statically. There can only be one image opened at a time. File names are encoded in UTF8 (a superset of ASCII), this is supported for Linux (only for locales encoded in UTF8) and Windows Returns IMG_INVALID() if the image can not be opened

IMG LEVEL_PINCLIENT::IMG_Prev (  IMG  x  )

Returns: Of the list of currently loaded images in memory it returns the image loaded prior to image x, or IMG_Invalid() if x is the first image Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

SYM LEVEL_PINCLIENT::IMG_RegsymHead (  IMG  x  )

Returns: First regular symbol in image Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

SEC LEVEL_PINCLIENT::IMG_SecHead (  IMG  x  )

Returns: First section in image Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

SEC LEVEL_PINCLIENT::IMG_SecTail (  IMG  x  )

Returns: Last section in image Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

USIZE LEVEL_PINCLIENT::IMG_SizeMapped (  IMG  x  )

Returns: the size of the image mapped Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

ADDRINT LEVEL_PINCLIENT::IMG_StartAddress (  IMG  x  )

Returns: the starting virtual address that the image is mapped to Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

IMG_TYPE LEVEL_PINCLIENT::IMG_Type (  IMG  x  )

Returns: Image type Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

BOOL LEVEL_PINCLIENT::IMG_Valid (  IMG  x  )

Returns: True if x is not IMG_Invalid() Availability: Mode: JIT & Probe O/S: Linux, Windows & MacOS CPU: All

---