Struct frida_gum::stalker::Stalker

pub struct Stalker<'a> { /* private fields */ }

Code tracing engine interface.

Implementations

impl<'a> Stalker<'a>

pub fn is_supported(_gum: &Gum) -> bool

Checks if the Stalker is supported on the current platform.

pub fn new<'b>(gum: &'b Gum) -> Stalker<'_>

where 'b: 'a,

Create a new Stalker.

This call has the overhead of checking if the Stalker is available on the current platform, as creating a Stalker on an unsupported platform results in unwanted behaviour.

pub fn new_with_params<'b>( gum: &'b Gum, ic_entries: u32, adjacent_blocks: u32 ) -> Stalker<'_>

where 'b: 'a,

Create a new Stalker with parameters

This call has the overhead of checking if the Stalker is available on the current platform, as creating a Stalker on an unsupported platform results in unwanted behaviour.

pub fn exclude(&mut self, range: &MemoryRange)

Exclude a range of address from the Stalker engine.

This exclusion will prevent the Stalker from tracing into the memory range, reducing instrumentation overhead as well as potential noise from the EventSink.

pub fn set_trust_threshold(&mut self, threshold: i32)

Set how many times a piece of code needs to be executed before it is assumed it can be trusted to not mutate.

Specify -1 for no trust (slow), 0 to trust code from the get-go, and N to trust code after it has been executed N times. Defaults to 1.

pub fn get_trust_threshold(&self) -> i32

Get the Stalker trust treshold, see Stalker::set_trust_threshold() for more details.

pub fn flush(&mut self)

Flush all buffered events.

pub fn stop(&mut self)

pub fn garbage_collect(&mut self) -> bool

Free accumulated memory at a safe point after Stalker::unfollow_me().

This is needed to avoid race-conditions where the thread just unfollowed is executing its last instructions.

pub fn follow<S: EventSink>( &mut self, thread_id: usize, transformer: &Transformer<'_>, event_sink: Option<&mut S> )

Available on crate feature event-sink only.

Begin the Stalker on the specific thread.

A Transformer must be specified, and will be updated with all events.

If reusing an existing Transformer, make sure to call Stalker::garbage_collect() periodically.

pub fn follow_me<S: EventSink>( &mut self, transformer: &Transformer<'_>, event_sink: Option<&mut S> )

Available on crate feature event-sink only.

Begin the Stalker on the current thread.

A Transformer must be specified, and will be updated with all events.

If reusing an existing Transformer, make sure to call Stalker::garbage_collect() periodically.

pub fn unfollow(&mut self, thread_id: usize)

Stop stalking the specific thread.

pub fn unfollow_me(&mut self)

Stop stalking the current thread.

pub fn is_following_me(&mut self) -> bool

Check if the Stalker is running on the current thread.

pub fn activate(&mut self, start: NativePointer)

Re-activate the Stalker at the specified start point.

pub fn deactivate(&mut self)

Pause the Stalker.

pub fn enable_unwind_hooking(&mut self)

Enable (experimental) unwind hooking

pub fn set_observer<O: StalkerObserver>(&mut self, observer: &mut O)

Available on crate feature stalker-observer only.

Trait Implementations

impl<'a> Drop for Stalker<'a>

fn drop(&mut self)

Executes the destructor for this type.