zelos.feeds module

Implementation of feeds.

Feeds are a way to subscribe to information that is retrieved from a dynamic execution of a binary, while respecting the performance optimizations that have been requested by the user. This way, a user can specify what kinds of information should be collected (each with their own performance cost) in a global way, without having to configure multiple plugins separately.

To start with, there are different levels of feeds, each increasing in amount of verbosity as well as performance cost:

         -> Verbosity ->
None -> Syscalls -> Functions -> Instructions
        <- Performance <-

The feed level determines what feeds are supplied with information. All feeds that are more verbose than the feed level are not provided data, and will not run subscribed callbacks.


When the feed level is FeedLevel.FUNC, subscribers to the syscall and func feeds will be run, but no calls to inst feed subscribers will be made.

Feeds are made more powerful by command line arguments that provide ways to modify the feed level based on events and conditions. This allows the user to specify that only instructions between certain regions should be collected. The conditions are specified through the –(stop|syscall|func|inst)_feed command line flags.


To trigger instructions to be printed only after the ‘recv’ syscall has been called, specify ‘–inst_feed=syscall=recv’ on the command line. For a script, add ‘inst_feed=”syscall=recv”’ as a keyword argument in the Zelos constructor.

For more information on what options are available for configuring feeds look at the zelos.zml module.

class zelos.feeds.FeedLevel

Bases: enum.IntEnum

An enumeration.

NONE = 0
FUNC = 2
INST = 3
class zelos.feeds.FeedHandle(feed_level, num)

Bases: object

Returned when subscribing to a feed. Used for unsubscribing to a feed.

class zelos.feeds.FeedManager(config, zml_parser: zelos.zml.ZmlParser, hook_manager: zelos.hooks.HookManager)

Bases: object

Handles feed subscribers as well as the feed level.

Subscription is handled by passing a callback to the subscribe_to_* functions.

property inst_feed_on
property func_feed_on
property syscall_feed_on
get_feed_level() → zelos.feeds.FeedLevel
set_feed_level(feed_level: zelos.feeds.FeedLevel)
subscribe_to_inst_feed(callback: Callable[[Zelos, int, int], Any]) → zelos.feeds.FeedHandle
subscribe_to_func_feed(callback) → zelos.feeds.FeedHandle
subscribe_to_syscall_feed(callback: Callable[[Zelos, str, Args, int], Any]) → zelos.feeds.FeedHandle
unsubscribe_from_feed(handle: zelos.feeds.FeedHandle)