Closed dellis23 closed 8 years ago
Yes indeed, the haystack-reverse script is not working fully. I removed temporarly some features that I know are not working right now.
You should be able to use this script with the following command line:
haystack-reverse test-ctypes6.64.dump instances
That will create a 'cache/' folder in test-ctypes6.64.dump/ which will contains a dump of every allocated chunks.
There is some enriched data in there too, but its not ready for use right now.
I need to clean up the whole "reverse" section of the haystack library.
For now, the working interesting part of haystack is limited to the search function.
You can take a look at the search and refresh functions of the haystack
script.
Or use the API (see https://github.com/trolldbois/python-haystack/blob/master/docs/Haystack%20basic%20usage.ipynb )
So I corrected the README.md and clarified the use of haystack-reverse.
On small, non complex programs, like the test programs, you should be able to use the script.
$ python haystack-reverse haystack/test/src/test-ctypes6.64.dump instances
$ ls -l haystack/test/src/test-ctypes6.64.dump/cache
$ ls -l haystack/test/src/test-ctypes6.64.dump/cache/structs
The most interesting one being the <yourdumpfolder>/cache/headers_values.py
that
gives you an ctypes listing of all found structures, with guesstimates
on fields types.
A
I added a IPython notebook https://github.com/trolldbois/python-haystack/blob/master/docs/Haystack%20reverse%20CLI.ipynb
Hi again. I successfully got a dump, and am trying to use some of the examples of haystack-reverse to take a look at them (at least, it seems like that's what it's for):
I'm happy to help with documentation improvements once I am able to get things working.