zelos.zml module¶
-
class
zelos.zml.
ConditionList
(conditions: Dict[str, str])¶ Bases:
object
Specifies common conditions that are used for other ConditionLists
-
is_satisfied
(zelos)¶
-
-
class
zelos.zml.
SyscallConditionList
(conditions: Dict[str, str])¶ Bases:
zelos.zml.ConditionList
Used to trigger an action after a specific syscall.
-
is_satisfied
(zelos, sysname, args, retval)¶
-
act_when_satisfied
(zelos, action: Callable[[], Any])¶
-
-
class
zelos.zml.
FuncConditionList
(conditions: Dict[str, str])¶ Bases:
zelos.zml.ConditionList
Used to trigger an action after a specific API.
-
is_satisfied
(zelos)¶
-
act_when_satisfied
(zelos, action: Callable[[], Any])¶
-
-
class
zelos.zml.
AddressConditionList
(conditions: Dict[str, str])¶ Bases:
zelos.zml.ConditionList
Used to trigger an action executing a specific address.
-
act_when_satisfied
(zelos, action: Callable[[], Any])¶
-
-
class
zelos.zml.
ThreadConditionList
(conditions: Dict[str, str])¶ Bases:
zelos.zml.ConditionList
Used to trigger an action upon switching to a certain thread.
-
act_when_satisfied
(zelos, action: Callable[[], Any])¶
-
-
class
zelos.zml.
EmptyConditionList
¶ Bases:
object
When no condition to activate an action is specified, default to enacting the action right now.
-
act_when_satisfied
(zelos, action: Callable[[], Any])¶
-
-
class
zelos.zml.
ZmlParser
(zelos)¶ Bases:
object
A parser for the ZML language. Can be used to generate condition lists.
-
trigger_on_zml
(action: Callable[[], Any], zml_string: str)¶
-
parse_zml_string
(zml_string: str) → Optional[zelos.hooks.HookInfo]¶
-
-
class
zelos.zml.
ZmlTransformer
(*args, **kwargs)¶ Bases:
lark.visitors.Transformer
Takes a ZML tree and creates a ConditionList object out of it.
-
condition_list
(tree)¶
-
thread_event
(children)¶
-
func_event
(children)¶
-
syscall_event
(children)¶
-
addr_event
(children)¶
-
thread_cond
(children)¶
-
n_cond
(children)¶
-
retval_cond
(children)¶
-
arg_cond
(children)¶
-
NUMBER
(s)¶
-
CNAME
(s)¶
-