pykdebugparser 1.2.8__py2.py3-none-any.whl → 1.3.0__py2.py3-none-any.whl

pykdebugparser/kd_buf_parser.py

@@ -1,21 +1,27 @@
-import struct
-from collections import namedtuple
+from dataclasses import dataclass, field
 import io
 import plistlib
+import struct
+from collections import namedtuple
+from typing import Annotated, Any
 
-from construct import Adapter, Struct, Const, Padding, Int32ul, Int64ul, Array, GreedyRange, Byte, FixedSized, \
-    CString, Prefixed, GreedyBytes, Aligned, Bytes, Select
+from bytestruct import GREEDY_BYTES, U64_LE, BinaryParseError, BinaryStruct, ByteReader, Bytes, CodecBase, \
+    PaddedString, Prefixed, TruncatedDataError, u32, u64
 
-from pykdebugparser.kevent import from_kd_buf, KD_BUF_FORMAT
+from pykdebugparser.kevent import from_kd_buf, from_kd_bufs, KD_BUF_FORMAT
 from pykdebugparser.os_log_event import OsLogEvent
 
 KEVENT_SIZE = struct.calcsize(KD_BUF_FORMAT)
+# Upper bound for a single bulk read of kevents.
+KEVENTS_READ_SIZE = KEVENT_SIZE * 1024
 
 ProcessData = namedtuple('ProcessData', ['pid', 'name'])
 
 RAW_VERSION_SIZE = 4
 RAW_VERSION2_BYTES = b'\x00\x02\xaa\x55'
 RAW_VERSION3_BYTES = b'\x00\x03\xaa\x55'
+# Header flag of a 64-bit kernel.
+KDBG_LP64 = 0x1
 TRACEV3_STACKSHOT_END = b'stackshot_out_fl'
 TRACEV3_THREADMAP_TAG = b'\x00\x1d\x00\x00\x00\x00\x00\x00'
 TRACEV3_EVENTS_TAG = b'\x00\x1e\x00\x00\x00\x00\x00\x00'
@@ -28,61 +34,131 @@ TRACEV3_LOG_STRINGS = b'\x12\x80\x00\x00\x00\x00\x00\x00'
 TRACEV3_KERNEL_EXTENSIONS = b'\x05\x80\x00\x00\x00\x00\x00\x00'
 TRACEV3_IMAGES = b'\x04\x80\x00\x00\x01\x00\x00\x00'
 
-kd_threadmap = Struct(
-    'tid' / Int64ul,
-    'pid' / Int32ul,
-    'process' / FixedSized(0x14, CString('utf8')),
-)
 
+class Bplist(CodecBase[Any]):
+    """
+    Codec for a plist (all remaining bytes).
+    """
+
+    def read(self, reader: ByteReader) -> Any:
+        return plistlib.loads(GREEDY_BYTES.read(reader))
+
+    def build(self, value: Any) -> bytes:
+        return plistlib.dumps(value)
 
-class BplistAdapter(Adapter):
+
+@dataclass
+class KdThreadmap(BinaryStruct, byte_order='<'):
+    tid: u64
+    pid: u32
+    process: Annotated[str, PaddedString(0x14)]
+
+
+@dataclass
+class KdHeaderV2(BinaryStruct, byte_order='<'):
     """
-    Construct adapter ti build and parse plists.
+    Header of a trace version 2 (`RAW_VERSION2`), as written by kperf's `kperf_buffer_readdata`.
+    The fields up to `tod_usecs` follow XNU's `RAW_header`; kperf always writes the time of day as zero.
     """
+    number_of_threads: u32
+    tod_secs: u64
+    tod_usecs: u32
+    flags: u32
+    tick_frequency: u64
+    # Never written by kperf, so it holds whatever the buffer contained before.
+    _unused: Annotated[bytes, Bytes(0x100)] = field(default=bytes(0x100), init=False, repr=False, compare=False)
 
-    def _decode(self, obj, context, path):
-        return plistlib.loads(obj)
+    @property
+    def is_64bit(self) -> bool:
+        return bool(self.flags & KDBG_LP64)
 
-    def _encode(self, obj, context, path):
-        return plistlib.dumps(obj)
 
+@dataclass
+class KdHeaderV3(BinaryStruct, byte_order='<'):
+    tag: u32
+    sub_tag: u32
+    length: u64
+    timebase_numer: u32
+    timebase_denom: u32
+    timestamp: u64
+    walltime_secs: u64
+    walltime_usecs: u32
+    timezone_minuteswest: u32
+    timezone_dst: u32
+    flags: u32
+    tag2: u32
+    cpu_info: Annotated[Any, Prefixed(U64_LE, Bplist())]
 
-kd_header_v2 = Struct(
-    'number_of_treads' / Int32ul,
-    Padding(8),
-    Padding(4),
-    'is_64bit' / Int32ul,
-    'tick_frequency' / Int64ul,
-    Padding(0x100),
-    'threadmap' / Array(lambda ctx: ctx.number_of_treads, kd_threadmap),
-    '_pad' / GreedyRange(Const(0, Byte)),
-)
 
-kd_header_v3 = Struct(
-    'tag' / Int32ul,
-    'sub_tag' / Int32ul,
-    'length' / Int64ul,
-    'timebase_numer' / Int32ul,
-    'timebase_denom' / Int32ul,
-    'timestamp' / Int64ul,
-    'walltime_secs' / Int64ul,
-    'walltime_usecs' / Int32ul,
-    'timezone_minuteswest' / Int32ul,
-    'timezone_dst' / Int32ul,
-    'flags' / Int32ul,
-    'tag2' / Int32ul,
-    'cpu_info' / Prefixed(Int64ul, BplistAdapter(GreedyBytes)),
+@dataclass
+class KdV3Block(BinaryStruct, byte_order='<'):
+    """
+    An additional data block of a trace version 3, aligned to 8 bytes (unless it is the last one).
+    """
+    tag: Annotated[bytes, Bytes(8)]
+    data: Annotated[bytes, Prefixed(U64_LE, GREEDY_BYTES)]
 
-)
 
-kd_v3_threadmap = Struct(
-    'threadmap' / Prefixed(Int64ul, GreedyRange(kd_threadmap)),
-)
+def read_exactly(reader: io.IOBase, size: int) -> bytes:
+    """
+    Read exactly `size` bytes from a stream.
+    :param reader: Stream to read from.
+    :param size: Number of bytes to read.
+    :return: The data read.
+    :raises TruncatedDataError: The stream ended first.
+    """
+    data = reader.read(size)
+    if len(data) != size:
+        raise TruncatedDataError(f'expected {size} bytes, found {len(data)}')
+    return data
+
+
+def skip_zeros(reader: io.IOBase):
+    """
+    Skip zero bytes in a stream, leaving it at the first non-zero byte (or at its end).
+    Reads a byte at a time and seeks back once, so a stream never consumes data past the zeros.
+    :param reader: Stream to skip in.
+    """
+    while True:
+        position = reader.tell()
+        if reader.read(1) != b'\x00':
+            reader.seek(position, 0)
+            return
+
+
+def parse_threadmap(data: bytes) -> list:
+    """
+    Parse consecutive threadmap entries, stopping at the first one that can't be parsed.
+    :param data: Threadmap entries.
+    :return: Parsed entries.
+    """
+    reader = ByteReader(data)
+    threadmap = []
+    while reader.remaining:
+        try:
+            threadmap.append(KdThreadmap.read(reader))
+        except BinaryParseError:
+            break
+    return threadmap
 
-kd_v3_additional_data = GreedyRange(Struct(
-    'tag' / Bytes(8),
-    'data' / Select(Aligned(8, Prefixed(Int64ul, GreedyBytes)), Prefixed(Int64ul, GreedyBytes)),
-))
+
+def parse_v3_blocks(data: bytes) -> list:
+    """
+    Parse the additional data blocks of a trace version 3, stopping at the first one that can't be parsed.
+    :param data: Additional data blocks.
+    :return: Parsed blocks.
+    """
+    reader = ByteReader(data)
+    blocks = []
+    while True:
+        try:
+            block = KdV3Block.read(reader)
+        except BinaryParseError:
+            break
+        blocks.append(block)
+        # The last block may be unpadded.
+        reader.skip(min(-(KdV3Block.SIZE + 8 + len(block.data)) % 8, reader.remaining))
+    return blocks
 
 
 def seek_until(reader, data: bytes):
@@ -138,13 +214,37 @@ class KdBufParser:
         :param reader: Stream to parse.
         :return: Generator for parsed kevents.
         """
-        parsed_header = kd_header_v2.parse_stream(reader)
-        self.set_thread_map(parsed_header.threadmap)
+        header = KdHeaderV2.parse(read_exactly(reader, KdHeaderV2.SIZE))
+        self.set_thread_map([KdThreadmap.parse(read_exactly(reader, KdThreadmap.SIZE))
+                             for _ in range(header.number_of_threads)])
+        skip_zeros(reader)
+        read1 = getattr(reader, 'read1', None)
+        if read1 is None:
+            # Without `read1` a bigger `read` might block until more data than currently available arrives.
+            while True:
+                buf = reader.read(KEVENT_SIZE)
+                if not buf:
+                    break
+                yield from_kd_buf(buf)
+            return
+        # `read1` returns whatever is available, so kevents are decoded in bulk without delaying live streams.
+        leftover = b''
         while True:
-            buf = reader.read(KEVENT_SIZE)
+            buf = read1(KEVENTS_READ_SIZE)
             if not buf:
                 break
-            yield from_kd_buf(buf)
+            if leftover:
+                buf = leftover + buf
+            end = len(buf) - len(buf) % KEVENT_SIZE
+            if end != len(buf):
+                leftover = buf[end:]
+                buf = buf[:end]
+            else:
+                leftover = b''
+            yield from from_kd_bufs(buf)
+        if leftover:
+            # A truncated kevent, fail just like a non-bulk read would.
+            yield from_kd_buf(leftover)
 
     def parse_v3(self, reader: io.IOBase):
         """
@@ -152,18 +252,21 @@ class KdBufParser:
         :param reader: Stream to parse.
         :return: Generator for parsed kevents.
         """
-        self.v3_header = Aligned(8, kd_header_v3).parse_stream(reader)
+        header = read_exactly(reader, KdHeaderV3.SIZE + U64_LE.size)
+        header += read_exactly(reader, U64_LE.unpack_from(header, KdHeaderV3.SIZE)[0])
+        read_exactly(reader, -len(header) % 8)
+        self.v3_header = KdHeaderV3.parse(header)
         # Align the reader to 8 bytes from the beginning of the stream
         reader.read(8 - RAW_VERSION_SIZE)
         # The threadmap tag appears randomly in the stackshot.
         seek_until(reader, TRACEV3_STACKSHOT_END)
         seek_until(reader, TRACEV3_THREADMAP_TAG)
-        threadmap = kd_v3_threadmap.parse_stream(reader).threadmap
-        self.set_thread_map(threadmap)
+        threadmap_size = U64_LE.parse(read_exactly(reader, U64_LE.size))
+        self.set_thread_map(parse_threadmap(read_exactly(reader, threadmap_size)))
 
         while True:
             seek_until(reader, TRACEV3_EVENTS_TAG)
-            size = Int64ul.parse_stream(reader)
+            size = U64_LE.parse(read_exactly(reader, U64_LE.size))
             reader.read(8)  # All zeros, unknown.
             for _ in range(size // KEVENT_SIZE):
                 buf = reader.read(KEVENT_SIZE)
@@ -172,7 +275,7 @@ class KdBufParser:
                 break
         reader.seek(-8, 1)
 
-        additional_data = kd_v3_additional_data.parse_stream(reader)
+        additional_data = parse_v3_blocks(reader.read())
 
         self.trace_codes = ''
         self.kernel_extensions = {'Binaries': []}

pykdebugparser/kevent.py

@@ -5,6 +5,9 @@ import struct
 KDBG_EVENTID_MASK = 0xfffffffc
 KDBG_FUNC_MASK = 0x00000003
 KD_BUF_FORMAT = '<Q32sQIIQ'
+# Same layout as `KD_BUF_FORMAT`, with the 32 bytes of arguments unpacked as 4 64-bit values.
+KD_BUF_STRUCT = struct.Struct('<QQQQQQIIQ')
+KD_BUF_SIZE = KD_BUF_STRUCT.size
 Kevent = namedtuple('Kevent', ['timestamp', 'data', 'values', 'tid', 'debugid', 'eventid', 'func_qualifier'])
 
 
@@ -24,8 +27,20 @@ def from_kd_buf(kd_buf: bytes) -> Kevent:
     :param kd_buf: Buffer of kd_buf kevent's struct.
     :return: Parsed kevent.
     """
-    timestamp, args_buf, tid, debugid, cpuid, unused = struct.unpack(KD_BUF_FORMAT, kd_buf)
-    eventid = debugid & KDBG_EVENTID_MASK
-    qual = debugid & KDBG_FUNC_MASK
-    args = struct.unpack('<QQQQ', args_buf)  # There are 4 arguments, 64 bit each.
-    return Kevent(timestamp, args_buf, args, tid, debugid, eventid, qual)
+    timestamp, arg0, arg1, arg2, arg3, tid, debugid, cpuid, unused = KD_BUF_STRUCT.unpack(kd_buf)
+    return Kevent(timestamp, kd_buf[8:40], (arg0, arg1, arg2, arg3), tid, debugid, debugid & KDBG_EVENTID_MASK,
+                  debugid & KDBG_FUNC_MASK)
+
+
+def from_kd_bufs(kd_bufs: bytes):
+    """
+    Create Kevent objects from consecutive kd_buf kevent's structs.
+    :param kd_bufs: Buffer of kd_buf kevent's structs, its length must be a multiple of the struct size.
+    :return: Generator of parsed kevents.
+    """
+    new_kevent = tuple.__new__  # Skips the namedtuple's Python-level __new__, the result is identical.
+    offset = 8
+    for timestamp, arg0, arg1, arg2, arg3, tid, debugid, cpuid, unused in KD_BUF_STRUCT.iter_unpack(kd_bufs):
+        yield new_kevent(Kevent, (timestamp, kd_bufs[offset:offset + 32], (arg0, arg1, arg2, arg3), tid, debugid,
+                                  debugid & KDBG_EVENTID_MASK, debugid & KDBG_FUNC_MASK))
+        offset += KD_BUF_SIZE

pykdebugparser/os_log_event.py

@@ -3,7 +3,7 @@ from datetime import datetime, timezone
 import enum
 from typing import List, Dict
 
-from construct import Struct, Byte, Int32ul, BitStruct, Padding, Flag, BitsInteger, Int64ul
+from bytestruct import U64_LE, BinaryStruct, u8, u32
 
 
 class OsLogType(enum.Enum):
@@ -81,7 +81,7 @@ class FirehoseTracepointSignpostType(enum.IntFlag):
     scope_system = 0xc0
 
 
-class FirehoseTracepointSingpostFlags(enum.Enum):
+class FirehoseTracepointSingpostFlags(enum.IntFlag):
     has_private_data = 1
     has_subsystem = 2
     has_rules = 4
@@ -100,22 +100,24 @@ tracepoint_types = {
 
 tracepoint_flags = {
     FirehoseTracepointNamespace.log: FirehoseTracepointLogFlags,
-    FirehoseTracepointNamespace.trace: FirehoseTracepointSingpostFlags,
+    FirehoseTracepointNamespace.signpost: FirehoseTracepointSingpostFlags,
 }
 
-firehose_tracepoint_id = Struct(
-    'namespace' / Byte,
-    'type_' / Byte,
-    'trace_flags' / BitStruct(
-        Padding(2),
-        'has_large_offset' / Flag,
-        'has_unique_pid' / Flag,
-        'pc_style' / BitsInteger(3),
-        'has_current_aid' / Flag,
-    ),
-    'flags' / Byte,
-    'code' / Int32ul,
-)
+# `trace_flags` bits.
+TRACE_FLAGS_HAS_LARGE_OFFSET = 0x20
+TRACE_FLAGS_HAS_UNIQUE_PID = 0x10
+TRACE_FLAGS_PC_STYLE_SHIFT = 1
+TRACE_FLAGS_PC_STYLE_MASK = 0x7
+TRACE_FLAGS_HAS_CURRENT_AID = 0x01
+
+
+@dataclass
+class FirehoseTracepointId(BinaryStruct, byte_order='<'):
+    namespace: u8
+    type_: u8
+    trace_flags: u8
+    flags: u8
+    code: u32
 
 
 @dataclass
@@ -262,7 +264,8 @@ class OsLogEvent:
 
     @classmethod
     def parse_trace_identifier(cls, trace_identifier):
-        trace_id = firehose_tracepoint_id.parse(Int64ul.build(trace_identifier))
+        trace_id = FirehoseTracepointId.parse(U64_LE.build(trace_identifier))
+        trace_flags = trace_id.trace_flags
         trace_namespace = FirehoseTracepointNamespace(trace_id.namespace)
         if trace_namespace in tracepoint_types:
             type_ = tracepoint_types[trace_namespace](trace_id.type_)
@@ -275,10 +278,10 @@ class OsLogEvent:
         return TraceIdentifier(
             namespace=trace_namespace,
             type_=type_,
-            has_large_offset=trace_id.trace_flags.has_large_offset,
-            has_unique_pid=trace_id.trace_flags.has_unique_pid,
-            pc_style=FirehoseTracepointFlagsPcStyle(trace_id.trace_flags.pc_style),
-            has_current_aid=trace_id.trace_flags.has_current_aid,
+            has_large_offset=bool(trace_flags & TRACE_FLAGS_HAS_LARGE_OFFSET),
+            has_unique_pid=bool(trace_flags & TRACE_FLAGS_HAS_UNIQUE_PID),
+            pc_style=FirehoseTracepointFlagsPcStyle((trace_flags >> TRACE_FLAGS_PC_STYLE_SHIFT) & TRACE_FLAGS_PC_STYLE_MASK),
+            has_current_aid=bool(trace_flags & TRACE_FLAGS_HAS_CURRENT_AID),
             flags=tracepoint_flags[trace_namespace](
                 trace_id.flags) if trace_namespace in tracepoint_flags else None,
             code=trace_id.code,

pykdebugparser/pykdebugparser.py

@@ -1,5 +1,6 @@
 from datetime import datetime
 import io
+import math
 
 from pygments import highlight, lexers, formatters
 from termcolor import colored
@@ -25,6 +26,8 @@ class PyKdebugParser:
         self.filter_process = None
         self.filter_class = []
         self.filter_subclass = []
+        # Event ids (debugids without the function qualifier) to include, on top of the class/subclass filters.
+        self.filter_eventid = set()
         self.show_timestamp = True
         self.show_name = True
         self.show_func_qual = True
@@ -41,15 +44,29 @@ class PyKdebugParser:
         self.pids_names = {}
         self.dyld_addresses = []
         self.dyld_uuids = []
+        self._timestamp_cache = None
 
     def kevents(self, kdebug: io.IOBase):
         events_generator = KdBufParser(self.threads_pids, self.pids_names).parse(kdebug)
-        events_generator = filter(lambda e: not isinstance(e, OsLogEvent), events_generator)
-        if self.filter_tid is not None:
-            events_generator = filter(lambda e: e.tid == self.filter_tid, events_generator)
-        if self.filter_class or self.filter_subclass:
-            events_generator = filter(lambda e: self._is_eventid_allowed(e.eventid), events_generator)
-        return events_generator
+        return self._filter_kevents(events_generator, self.filter_tid is not None,
+                                    bool(self.filter_class or self.filter_subclass or self.filter_eventid))
+
+    def _filter_kevents(self, events_generator, by_tid, by_class):
+        # A single generator instead of a `filter` chain, avoiding a lambda call per kevent per filter.
+        filter_class = self.filter_class
+        filter_subclass = self.filter_subclass
+        filter_eventid = set(self.filter_eventid)
+        for event in events_generator:
+            if isinstance(event, OsLogEvent):
+                continue
+            if by_tid and event.tid != self.filter_tid:
+                continue
+            if by_class:
+                eventid = event.eventid
+                if not ((eventid >> 24 in filter_class) or (eventid >> 16 in filter_subclass)
+                        or eventid in filter_eventid):
+                    continue
+            yield event
 
     def formatted_kevents(self, kdebug: io.IOBase, trace_codes=None):
         trace_codes_map = default_trace_codes() if trace_codes is None else trace_codes
@@ -58,11 +75,12 @@ class PyKdebugParser:
     def traces(self, kdebug: io.IOBase, trace_codes=None):
         trace_codes_map = default_trace_codes() if trace_codes is None else trace_codes
 
-        has_filters = self.filter_class or self.filter_subclass
+        has_filters = self.filter_class or self.filter_subclass or self.filter_eventid
         add_trace_class = has_filters and DBG_TRACE not in self.filter_class
         if add_trace_class:
             self.filter_class.append(DBG_TRACE)
-        has_bsd = DBG_BSD in self.filter_class or any(filter(lambda sc: sc >> 8 == DBG_BSD, self.filter_subclass))
+        has_bsd = (DBG_BSD in self.filter_class or any(sc >> 8 == DBG_BSD for sc in self.filter_subclass)
+                   or any(eventid >> 24 == DBG_BSD for eventid in self.filter_eventid))
         add_fs_class = has_filters and has_bsd and DBG_FSYSTEM not in self.filter_class
         if add_fs_class:
             self.filter_class.append(DBG_FSYSTEM)
@@ -113,9 +131,22 @@ class PyKdebugParser:
         offset_usec = (
                 ((timestamp - self.mach_absolute_time) * self.numer) / (self.denom * 1000)
         )
-        ts = datetime.fromtimestamp((self.usecs_since_epoch + offset_usec) / 1000000, tz=self.timezone)
-        time_string = ts.strftime('%Y-%m-%d %H:%M:%S.%f')
-        return f'{time_string:<27}'
+        posix_time = (self.usecs_since_epoch + offset_usec) / 1000000
+        # Split to seconds and microseconds exactly like `datetime.fromtimestamp` does (round half to even), so
+        # the date and time part can be formatted only once per second.
+        fraction, seconds = math.modf(posix_time)
+        microseconds = round(fraction * 1000000)
+        if microseconds >= 1000000:
+            microseconds -= 1000000
+            seconds += 1.0
+        elif microseconds < 0:
+            microseconds += 1000000
+            seconds -= 1.0
+        cache = self._timestamp_cache
+        if cache is None or cache[0] != seconds or cache[1] is not self.timezone:
+            prefix = datetime.fromtimestamp(seconds, tz=self.timezone).strftime('%Y-%m-%d %H:%M:%S.')
+            cache = self._timestamp_cache = (seconds, self.timezone, prefix)
+        return f'{cache[2]}{microseconds:06d}'.ljust(27)
 
     def _format_process(self, tid):
         pid = self.threads_pids.get(tid, -1)
@@ -184,4 +215,5 @@ class PyKdebugParser:
         return event_rep
 
     def _is_eventid_allowed(self, event_id):
-        return (event_id >> 24 in self.filter_class) or (event_id >> 16 in self.filter_subclass)
+        return ((event_id >> 24 in self.filter_class) or (event_id >> 16 in self.filter_subclass)
+                or event_id in self.filter_eventid)

pykdebugparser/trace_codes.py

@@ -1,4 +1,4 @@
-from typing import Mapping
+from typing import Iterable, Mapping, Optional, Set
 from pathlib import Path
 
 
@@ -28,3 +28,25 @@ def default_trace_codes() -> Mapping[int, str]:
     """
     with open(Path(__file__).resolve().parent.joinpath('trace.codes'), 'r') as fd:
         return from_trace_codes_text(fd.read())
+
+
+def syscall_eventids(names: Iterable[str], trace_codes: Optional[Mapping[int, str]] = None) -> Set[int]:
+    """
+    Get the event ids of BSD syscalls by name, for `PyKdebugParser.filter_eventid`.
+    A name also matches its `_nocancel` variant (e.g. `open` gives `BSC_open` and `BSC_open_nocancel`).
+    :param names: Syscall names, such as `open` or `openat`.
+    :param trace_codes: Mapping between code and event name; the default trace codes if omitted.
+    :return: The event ids.
+    :raises ValueError: A name is not a known syscall.
+    """
+    codes = {name: code for code, name in (default_trace_codes() if trace_codes is None else trace_codes).items()}
+    eventids = set()
+    unknown = []
+    for name in names:
+        matches = {codes[event] for event in (f'BSC_{name}', f'BSC_{name}_nocancel') if event in codes}
+        if not matches:
+            unknown.append(name)
+        eventids |= matches
+    if unknown:
+        raise ValueError(f'unknown syscalls: {", ".join(unknown)}')
+    return eventids

pykdebugparser/trace_handlers/__init__.py

@@ -0,0 +1,23 @@
+class UnknownEnumValue(int):
+    """
+    A raw value that its enum doesn't define (e.g. a combination of flags or a value added in a newer OS).
+    It has `name` and `value` like an enum member, so it is formatted as the raw number instead of failing the parse.
+    """
+
+    @property
+    def name(self) -> str:
+        return str(int(self))
+
+    @property
+    def value(self) -> int:
+        return int(self)
+
+
+def parse_enum(enum_type, value):
+    """
+    Convert a raw value to an enum member, falling back to `UnknownEnumValue` for values the enum doesn't define.
+    """
+    try:
+        return enum_type(value)
+    except ValueError:
+        return UnknownEnumValue(value)

pykdebugparser/trace_handlers/bsd.py

@@ -7,6 +7,8 @@ from signal import Signals
 import socket
 from typing import List
 
+from pykdebugparser.trace_handlers import parse_enum
+
 IOC_REQUEST_PARAMS = {
     0x20000000: 'IOC_VOID',
     0x40000000: 'IOC_OUT',
@@ -270,7 +272,7 @@ class SocketOptionName(enum.Enum):
 
 def sockopt_format_level_and_option(level, option_name):
     if level == socket.SOL_SOCKET:
-        return 'SOL_SOCKET', SocketOptionName(option_name).name
+        return 'SOL_SOCKET', parse_enum(SocketOptionName, option_name).name
     else:
         return level, option_name
 
@@ -5151,7 +5153,7 @@ def handle_getgid(parser, events):
 
 def handle_sigprocmask(parser, events):
     args = events[0].values
-    return BscSigprocmap(events, SigprocmaskFlags(args[0]), args[1], args[2], serialize_result(events[-1]))
+    return BscSigprocmap(events, parse_enum(SigprocmaskFlags, args[0]), args[1], args[2], serialize_result(events[-1]))
 
 
 def handle_getlogin(parser, events):
@@ -5282,7 +5284,7 @@ def handle_sys_dup2(parser, events):
 
 def handle_sys_fcntl(parser, events, no_cancel=False):
     args = events[0].values
-    return BscSysFcntl(events, args[0], FcntlCmd(args[1]), args[2], serialize_result(events[-1], 'return'),
+    return BscSysFcntl(events, args[0], parse_enum(FcntlCmd, args[1]), args[2], serialize_result(events[-1], 'return'),
                        no_cancel)
 
 
@@ -5297,13 +5299,13 @@ def handle_fsync(parser, events, no_cancel=False):
 
 def handle_setpriority(parser, events):
     args = events[0].values
-    return BscSetpriority(events, PriorityWhich(args[0]), args[1], args[2], serialize_result(events[-1]))
+    return BscSetpriority(events, parse_enum(PriorityWhich, args[0]), args[1], args[2], serialize_result(events[-1]))
 
 
 def handle_socket(parser, events):
     args = events[0].values
-    return BscSocket(events, socket.AddressFamily(args[0]), socket.SocketKind(args[1]), args[2],
-                     serialize_result(events[-1], 'fd'))
+    return BscSocket(events, parse_enum(socket.AddressFamily, args[0]), parse_enum(socket.SocketKind, args[1]),
+                     args[2], serialize_result(events[-1], 'fd'))
 
 
 def handle_connect(parser, events, no_cancel=False):
@@ -5313,7 +5315,7 @@ def handle_connect(parser, events, no_cancel=False):
 
 def handle_getpriority(parser, events):
     args = events[0].values
-    return BscGetpriority(events, PriorityWhich(args[0]), args[1], serialize_result(events[-1], 'priority'))
+    return BscGetpriority(events, parse_enum(PriorityWhich, args[0]), args[1], serialize_result(events[-1], 'priority'))
 
 
 def handle_bind(parser, events):
@@ -5342,7 +5344,7 @@ def handle_gettimeofday(parser, events):
 
 def handle_getrusage(parser, events):
     args = events[0].values
-    return BscGetrusage(events, RusageWho(ctypes.c_int32(args[0]).value), args[1], serialize_result(events[-1]))
+    return BscGetrusage(events, parse_enum(RusageWho, ctypes.c_int32(args[0]).value), args[1], serialize_result(events[-1]))
 
 
 def handle_getsockopt(parser, events):
@@ -5415,8 +5417,8 @@ def handle_shutdown(parser, events):
 
 def handle_socketpair(parser, events):
     args = events[0].values
-    return BscSocketpair(events, socket.AddressFamily(args[0]), socket.SocketKind(args[1]), args[2], args[3],
-                         serialize_result(events[-1]))
+    return BscSocketpair(events, parse_enum(socket.AddressFamily, args[0]), parse_enum(socket.SocketKind, args[1]),
+                         args[2], args[3], serialize_result(events[-1]))
 
 
 def handle_mkdir(parser, events):
@@ -5517,12 +5519,12 @@ def handle_mount(parser, events):
 
 def handle_csops(parser, events):
     args = events[0].values
-    return BscCsops(events, args[0], CsopsOps(args[1]), args[2], args[3], serialize_result(events[-1]))
+    return BscCsops(events, args[0], parse_enum(CsopsOps, args[1]), args[2], args[3], serialize_result(events[-1]))
 
 
 def handle_csops_audittoken(parser, events):
     args = events[0].values
-    return BscCsopsAudittoken(events, args[0], CsopsOps(args[1]), args[2], args[3], serialize_result(events[-1]))
+    return BscCsopsAudittoken(events, args[0], parse_enum(CsopsOps, args[1]), args[2], args[3], serialize_result(events[-1]))
 
 
 def handle_waitid(parser, events, no_cancel=False):
@@ -5969,7 +5971,7 @@ def handle_semwait_signal(parser, events, no_cancel=False):
 
 def handle_proc_info(parser, events):
     args = events[0].values
-    return BscProcInfo(events, ProcInfoCall(args[0]), args[1], args[2], args[3], serialize_result(events[-1]))
+    return BscProcInfo(events, parse_enum(ProcInfoCall, args[0]), args[1], args[2], args[3], serialize_result(events[-1]))
 
 
 def handle_sendfile(parser, events):
@@ -6199,8 +6201,8 @@ def handle_peeloff(parser, events):
 
 def handle_socket_delegate(parser, events):
     args = events[0].values
-    return BscSocketDelegate(events, socket.AddressFamily(args[0]), socket.SocketKind(args[1]), args[2], args[3],
-                             serialize_result(events[-1], 'fd'))
+    return BscSocketDelegate(events, parse_enum(socket.AddressFamily, args[0]),
+                             parse_enum(socket.SocketKind, args[1]), args[2], args[3], serialize_result(events[-1], 'fd'))
 
 
 def handle_telemetry(parser, events):
@@ -6543,7 +6545,8 @@ def handle_fs_snapshot(parser, events):
     nodes = parser.parse_vnodes(events)
     name2 = nodes[1].path if len(nodes) > 1 else ''
     args = events[0].values
-    return BscFsSnapshot(events, FsSnapshotOp(args[0]), args[1], nodes[0].path, name2, serialize_result(events[-1]))
+    return BscFsSnapshot(events, parse_enum(FsSnapshotOp, args[0]), args[1], nodes[0].path, name2,
+                         serialize_result(events[-1]))
 
 
 def handle_terminate_with_payload(parser, events):

pykdebugparser/trace_handlers/mach.py

@@ -4,6 +4,8 @@ from enum import Enum
 from functools import partial
 from typing import List
 
+from pykdebugparser.trace_handlers import parse_enum
+
 
 class AsynchronousSystemTrapsReason(Enum):
     AST_NONE = 0x00
@@ -31,11 +33,15 @@ class AsynchronousSystemTrapsReason(Enum):
     AST_UNQUIESCE = 0x200000
 
 
+# Pairs of (member, value), accessing `.value` through the enum descriptor is slow.
+_ASYNCHRONOUS_SYSTEM_TRAPS_REASON_VALUES = [(m, m.value) for m in AsynchronousSystemTrapsReason]
+
+
 def to_ast_reasons(flags: int):
     if not flags:
         return [AsynchronousSystemTrapsReason.AST_NONE]
     else:
-        return [r for r in AsynchronousSystemTrapsReason if r.value & flags]
+        return [r for r, value in _ASYNCHRONOUS_SYSTEM_TRAPS_REASON_VALUES if value & flags]
 
 
 # osfmk/arm64/proc_reg.h
@@ -86,8 +92,11 @@ class ThreadState(Enum):
     TH_IDLE = 0x80
 
 
+_THREAD_STATE_VALUES = [(m, m.value) for m in ThreadState]
+
+
 def to_thread_state(flags: int):
-    return [s for s in ThreadState if s.value & flags]
+    return [s for s, value in _THREAD_STATE_VALUES if value & flags]
 
 
 class InterruptType(Enum):
@@ -134,11 +143,14 @@ class VmProtection(Enum):
     VM_PROT_STRIP_READ = 0x80
 
 
+_VM_PROTECTION_VALUES = [(m, m.value) for m in VmProtection]
+
+
 def to_vm_prot(flags: int):
     if not flags:
         return [VmProtection.VM_PROT_NONE]
     else:
-        return [p for p in VmProtection if p.value & flags]
+        return [p for p, value in _VM_PROTECTION_VALUES if value & flags]
 
 
 # osfmk/mach/port.h
@@ -309,7 +321,7 @@ class Interrupt:
     type: int
 
     def __str__(self):
-        return f'INTERRUPT, pc: {hex(self.pc)}, is_user: {self.is_user}, type: {InterruptType(self.type).name}'
+        return f'INTERRUPT, pc: {hex(self.pc)}, is_user: {self.is_user}, type: {parse_enum(InterruptType, self.type).name}'
 
 
 @dataclass
@@ -1047,7 +1059,7 @@ def handle_msc_mach_vm_map_trap(parser, events):
 
 def handle_msc_mach_port_allocate_trap(parser, events):
     args = events[0].values
-    return MachPortAllocate(events, args[0], MachPortRight(args[1]), args[2])
+    return MachPortAllocate(events, args[0], parse_enum(MachPortRight, args[1]), args[2])
 
 
 def handle_msc_mach_port_deallocate_trap(parser, events):
@@ -1056,11 +1068,11 @@ def handle_msc_mach_port_deallocate_trap(parser, events):
 
 def handle_msc_mach_port_mod_refs_trap(parser, events):
     args = events[0].values
-    return MachPortModRefs(events, args[0], args[1], MachPortRight(args[2]), args[3])
+    return MachPortModRefs(events, args[0], args[1], parse_enum(MachPortRight, args[2]), args[3])
 
 
 def handle_msc_mach_port_insert_right_trap(parser, events):
-    return MachPortInsertRight(events, *events[0].values[:3], MachMsgTypeName(events[0].values[3]))
+    return MachPortInsertRight(events, *events[0].values[:3], parse_enum(MachMsgTypeName, events[0].values[3]))
 
 
 def handle_msc_mach_port_insert_member_trap(parser, events):
@@ -1105,12 +1117,12 @@ def handle_msc_semaphore_wait_trap(parser, events):
 
 def handle_msc_semaphore_timedwait_trap(parser, events):
     args = events[0].values
-    return SemaphoreTimedwait(events, args[0], args[1] & 0xffffffff, args[2], KernReturn(events[-1].values[0]))
+    return SemaphoreTimedwait(events, args[0], args[1] & 0xffffffff, args[2], parse_enum(KernReturn, events[-1].values[0]))
 
 
 def handle_msc_mach_port_get_attributes_trap(parser, events):
     args = events[0].values
-    return MachPortGetAttributes(events, *args[:2], MachPortFlavor(args[2]), args[3])
+    return MachPortGetAttributes(events, *args[:2], parse_enum(MachPortFlavor, args[2]), args[3])
 
 
 def handle_msc_mach_port_guard_trap(parser, events):
@@ -1135,7 +1147,7 @@ def handle_msc_thread_get_special_reply_port(parser, events):
 
 def handle_msc_thread_switch(parser, events):
     args = events[0].values
-    return ThreadSwitch(events, args[0], SwitchOption(args[1]), args[2])
+    return ThreadSwitch(events, args[0], parse_enum(SwitchOption, args[1]), args[2])
 
 
 def handle_msc_host_create_mach_voucher_trap(parser, events):
@@ -1176,7 +1188,7 @@ def handle_msc_mk_timer_cancel(parser, events):
 
 def handle_msc_mk_timer_arm_leeway(parser, events):
     args = events[0].values
-    return MkTimerArmLeeway(events, args[0], MkTimerFlags(args[1]), args[2], args[3])
+    return MkTimerArmLeeway(events, args[0], parse_enum(MkTimerFlags, args[1]), args[2], args[3])
 
 
 def handle_msc_iokit_user_client(parser, events):
@@ -1200,7 +1212,7 @@ def handle_mach_vmfault(parser, events):
     pid = None
     caller_prot = None
     if result == 0:
-        fault_type = DbgVmFaultType(rets[3])
+        fault_type = parse_enum(DbgVmFaultType, rets[3])
         real_events = [e for e in events[1:-1] if 0x1320008 <= e.eventid <= 0x1320014]
         if real_events:
             vm_fault_real = parser.parse_event_list(real_events)
@@ -1212,7 +1224,7 @@ def handle_mach_vmfault(parser, events):
 def handle_real_fault_address(addr_type, parser, events):
     args = events[0].values
     caller_prot = to_vm_prot((args[1] >> 8) & 0xff)
-    fault_type = DbgVmFaultType(args[1] & 0xff)
+    fault_type = parse_enum(DbgVmFaultType, args[1] & 0xff)
     return addr_type(events, args[0], args[1] >> 16, caller_prot, fault_type, args[2], args[3])
 
 
@@ -1233,7 +1245,7 @@ def handle_mach_mkrunnable(parser, events):
 
 def handle_mach_idle(parser, events):
     args = events[-1].values
-    return MachIdle(events, args[0], ProcessState(args[1]), args[2], to_ast_reasons(args[3]))
+    return MachIdle(events, args[0], parse_enum(ProcessState, args[1]), args[2], to_ast_reasons(args[3]))
 
 
 def handle_mach_block(parser, events):

pykdebugparser/trace_handlers/perf.py

@@ -21,8 +21,12 @@ class SamplerAction(Enum):
     SAMPLER_TK_INFO = 0x2000
 
 
+# Pairs of (member, value), accessing `.value` through the enum descriptor is slow.
+_SAMPLER_ACTION_VALUES = [(m, m.value) for m in SamplerAction]
+
+
 def to_sampler_action(flags: int):
-    return [s for s in SamplerAction if s.value & flags]
+    return [s for s, value in _SAMPLER_ACTION_VALUES if value & flags]
 
 
 class KperfTiState(Enum):
@@ -35,8 +39,11 @@ class KperfTiState(Enum):
     KPERF_TI_IDLE = 0x40
 
 
+_KPERF_TI_STATE_VALUES = [(m, m.value) for m in KperfTiState]
+
+
 def to_kperf_ti_state(flags: int):
-    return [s for s in KperfTiState if s.value & flags]
+    return [s for s, value in _KPERF_TI_STATE_VALUES if value & flags]
 
 
 class CallstackFlag(Enum):
@@ -51,8 +58,11 @@ class CallstackFlag(Enum):
     CALLSTACK_FIXUP_PC = 0x100
 
 
+_CALLSTACK_FLAG_VALUES = [(m, m.value) for m in CallstackFlag]
+
+
 def to_callstack_flags(flags: int):
-    return [c for c in CallstackFlag if c.value & flags]
+    return [c for c, value in _CALLSTACK_FLAG_VALUES if value & flags]
 
 
 @dataclass

pykdebugparser/trace_handlers/turnstile.py

@@ -2,6 +2,8 @@ from dataclasses import dataclass
 from enum import Enum
 from typing import List
 
+from pykdebugparser.trace_handlers import parse_enum
+
 
 class TurnstileType(Enum):
     TURNSTILE_NONE = 0
@@ -232,11 +234,11 @@ def handle_thread_user_promotion_change(parser, events):
 
 
 def handle_turnstile_turnstile_prepare(parser, events):
-    return TurnstilePrepare(events, *events[0].values[:2], TurnstileType(events[0].values[2]))
+    return TurnstilePrepare(events, *events[0].values[:2], parse_enum(TurnstileType, events[0].values[2]))
 
 
 def handle_turnstile_turnstile_complete(parser, events):
-    return TurnstileComplete(events, *events[0].values[:2], TurnstileType(events[0].values[2]))
+    return TurnstileComplete(events, *events[0].values[:2], parse_enum(TurnstileType, events[0].values[2]))
 
 
 handlers = {

pykdebugparser/traces_parser.py

@@ -39,26 +39,27 @@ class TracesParser:
         self.handlers.update(turnstile_handlers)
 
     def feed(self, event):
-        if event.eventid in self.trace_codes:
-            trace_name = self.trace_codes[event.eventid]
-            if trace_name in trace_handlers:
-                return self.qualifiers_actions[event.func_qualifier](event, self.on_going_traces)
+        trace_name = self.trace_codes.get(event.eventid)
+        if trace_name is not None and trace_name in trace_handlers:
+            return self.qualifiers_actions[event.func_qualifier](event, self.on_going_traces)
 
         return self.qualifiers_actions[event.func_qualifier](event, self.on_going_events)
 
     def feed_generator(self, generator):
+        feed = self.feed
         for event in generator:
-            ret = self.feed(event)
+            ret = feed(event)
             if ret is not None:
                 yield ret
 
     def parse_event_list(self, events):
-        if events[0].eventid not in self.trace_codes:
+        trace_name = self.trace_codes.get(events[0].eventid)
+        if trace_name is None:
             return None
-        trace_name = self.trace_codes[events[0].eventid]
-        if trace_name not in self.handlers:
+        handler = self.handlers.get(trace_name)
+        if handler is None:
             return None
-        return self.handlers[trace_name](self, events)
+        return handler(self, events)
 
     @staticmethod
     def vnode_generator(events):
@@ -89,26 +90,30 @@ class TracesParser:
         return list(self.vnode_generator([e for e in events if self.trace_codes.get(e.eventid) == 'VFS_LOOKUP']))
 
     def _feed_start_event(self, event, state):
-        if event.tid not in state:
+        tid_state = state.get(event.tid)
+        if tid_state is None:
             # New tid
-            state[event.tid] = {}
+            tid_state = state[event.tid] = {}
 
-        state[event.tid][event.eventid] = []
-        for eventid in state[event.tid]:
-            state[event.tid][eventid].append(event)
+        tid_state[event.eventid] = []
+        for events in tid_state.values():
+            events.append(event)
 
     def _feed_end_event(self, event, state):
-        if event.tid not in state or event.eventid not in state[event.tid]:
+        tid_state = state.get(event.tid)
+        if tid_state is None or event.eventid not in tid_state:
             # Event end without start.
             return
 
-        for eventid in state[event.tid]:
-            state[event.tid][eventid].append(event)
+        for events in tid_state.values():
+            events.append(event)
 
-        events = state[event.tid].pop(event.eventid)
+        events = tid_state.pop(event.eventid)
         return self.parse_event_list(events)
 
     def _feed_single_event(self, event, state):
-        for eventid in state.get(event.tid, {}):
-            state[event.tid][eventid].append(event)
+        tid_state = state.get(event.tid)
+        if tid_state:
+            for events in tid_state.values():
+                events.append(event)
         return self.parse_event_list([event])

{pykdebugparser-1.2.8.dist-info → pykdebugparser-1.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pykdebugparser
-Version: 1.2.8
+Version: 1.3.0
 Summary: Python parser for kdebug events
 Author: Matan Perelman
 Author-email: matan1008@gmail.com
@@ -28,17 +28,17 @@ License: MIT License
         
 Project-URL: Homepage, https://github.com/matan1008/pykdebugparser
 Project-URL: Source, https://github.com/matan1008/pykdebugparser
-Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Python: >=3.8
+Classifier: Programming Language :: Python :: 3.15
+Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: construct
+Requires-Dist: bytestruct>=0.1.0
 Requires-Dist: pygments
 Requires-Dist: click
 Requires-Dist: termcolor

pykdebugparser-1.3.0.dist-info/RECORD

@@ -0,0 +1,24 @@
+pykdebugparser/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+pykdebugparser/__main__.py,sha256=WfgLv5SGr0hQlUeM68ai1g0AqtYDgDFqYlbvvm5rua4,3711
+pykdebugparser/callstacks_parser.py,sha256=i2nfhx0olZZ65UV_ZV3Tw9E_6SWtre8CAbfRBSig4-E,1654
+pykdebugparser/kd_buf_parser.py,sha256=CpifFeBnQ_MZSokjO44lzhXO-KNnZvO-teaPyQqSfio,10991
+pykdebugparser/kevent.py,sha256=DudovIuES4QGxosYeEFJm3AW_FWGbJJBH1kcLnL7UFM,1779
+pykdebugparser/os_log_event.py,sha256=OQUlHpS44oUNwma_bxvnK0SKh_RFeEUdH1RmyrM4nLc,12356
+pykdebugparser/pykdebugparser.py,sha256=z8R20sBeohiQUV2QvQjqNOhFyg6PGsM6tri3joGbccw,10108
+pykdebugparser/trace.codes,sha256=smXNbWkJyxXEZpaeXTkeFU7zrBTAMeXxw-_bIV70LTw,90621
+pykdebugparser/trace_codes.py,sha256=4ImGc_jNpY-12cGXdwy6NMCEYcI24oYn1NBOaKNdWNo,1984
+pykdebugparser/traces_parser.py,sha256=Xq6nDvc5mSv25efaNSWIVc9ZO_dq8UPkbel-MqTXZ4Y,4442
+pykdebugparser/trace_handlers/__init__.py,sha256=r1dzmNTxiEtgENq9WFRVQX0g9f9dRxgAgVxjDXSc7s4,679
+pykdebugparser/trace_handlers/bsd.py,sha256=QVXPjWqm4bHhvbHpE32AwieaLyvwkxvzn6T1oT-4sBg,173654
+pykdebugparser/trace_handlers/dyld.py,sha256=ydyFhEkXKJzgo-1X5bH7UqiiLAenUa-KpBDfgSXMuAM,6839
+pykdebugparser/trace_handlers/fsystem.py,sha256=yOILOEuQDdjPDKq6HhzsjI27z36fkT6TqgCBddTvENg,417
+pykdebugparser/trace_handlers/mach.py,sha256=JL1v4rCCdGULsnVm3CYOLegL3JqNt3u7X-lJw1xzBRQ,35023
+pykdebugparser/trace_handlers/perf.py,sha256=CBffheZFlHa9IOVUZ-UcjNtKmjamv-un44bRJYYo9dw,5070
+pykdebugparser/trace_handlers/trace.py,sha256=Lu8s9XT1jb5avtrVXF6SQ6FUj93xYc0TwJd7yoIjV9U,5377
+pykdebugparser/trace_handlers/turnstile.py,sha256=8zZfba2Obq7a6qdhLIkItmZxRzzOe1PTTeHnrLuJUx0,8233
+pykdebugparser-1.3.0.dist-info/licenses/LICENSE,sha256=KjZXYP_CGYzDTtVfcxPT6wlGRoQKHPSJu0vh55_2QSo,1071
+pykdebugparser-1.3.0.dist-info/METADATA,sha256=McG8-jtDn654bLjLmCSCJULcJj4lBXJGfTJSwAyQLwU,18995
+pykdebugparser-1.3.0.dist-info/WHEEL,sha256=4YBfCYNH4wlLpv3pzq1hbEuIlXA4WJabKLFurZ7eTL0,109
+pykdebugparser-1.3.0.dist-info/entry_points.txt,sha256=NrVIOgPR6v2MbpTZ3aKedP1jQ93nUQus6sgP4wAD0_E,63
+pykdebugparser-1.3.0.dist-info/top_level.txt,sha256=FcHHXR9VKmqufFw0a6UP4c8NyS-u4ORY-yXQ6ZzP_28,15
+pykdebugparser-1.3.0.dist-info/RECORD,,

{pykdebugparser-1.2.8.dist-info → pykdebugparser-1.3.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (83.0.0)
+Generator: setuptools (84.0.0)
 Root-Is-Purelib: true
 Tag: py2-none-any
 Tag: py3-none-any

pykdebugparser-1.2.8.dist-info/RECORD

@@ -1,24 +0,0 @@
-pykdebugparser/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-pykdebugparser/__main__.py,sha256=WfgLv5SGr0hQlUeM68ai1g0AqtYDgDFqYlbvvm5rua4,3711
-pykdebugparser/callstacks_parser.py,sha256=i2nfhx0olZZ65UV_ZV3Tw9E_6SWtre8CAbfRBSig4-E,1654
-pykdebugparser/kd_buf_parser.py,sha256=H87PsFFRBKdilIW2IDuR2MtTLb0LBnoDEVyhXTrNeEc,7255
-pykdebugparser/kevent.py,sha256=-wz8HnSwpW2IbcEg3In3R5JF2EOYt-9Q77HudXKdBZM,951
-pykdebugparser/os_log_event.py,sha256=jNBp64RRAsqKSpJwf6Jnf0-ZiWDIMsCJ1FyBgfkjN_M,12251
-pykdebugparser/pykdebugparser.py,sha256=_fFvSzWn6t5WWuvCBM4aqr052pahq-fDjW-HzsWx1HY,8507
-pykdebugparser/trace.codes,sha256=smXNbWkJyxXEZpaeXTkeFU7zrBTAMeXxw-_bIV70LTw,90621
-pykdebugparser/trace_codes.py,sha256=cixU1NW149TvMk8_dKJHHrpyUr9JXyVsD815mqG7mVc,938
-pykdebugparser/traces_parser.py,sha256=sUYPynanzyrlJZ82umbp-Jzp_pvtNQ8U8KyBgtK5LvE,4382
-pykdebugparser/trace_handlers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-pykdebugparser/trace_handlers/bsd.py,sha256=CaVVORps_mce02T8aewQA747KQfLhD_Yk4uNMFS2qN0,173383
-pykdebugparser/trace_handlers/dyld.py,sha256=ydyFhEkXKJzgo-1X5bH7UqiiLAenUa-KpBDfgSXMuAM,6839
-pykdebugparser/trace_handlers/fsystem.py,sha256=yOILOEuQDdjPDKq6HhzsjI27z36fkT6TqgCBddTvENg,417
-pykdebugparser/trace_handlers/mach.py,sha256=jXcNblxJf4eM5_hyvR02jYk9zzFuN6iDIvUc3Mbn4qY,34486
-pykdebugparser/trace_handlers/perf.py,sha256=OX79TBNN4rFTmm2vwt17HphGzC9LLnimkcbtQqZeT7Y,4749
-pykdebugparser/trace_handlers/trace.py,sha256=Lu8s9XT1jb5avtrVXF6SQ6FUj93xYc0TwJd7yoIjV9U,5377
-pykdebugparser/trace_handlers/turnstile.py,sha256=E8sRF3mvNMKLj465YfMpFgfF-5b6K_EbC7te8p0W0Mc,8155
-pykdebugparser-1.2.8.dist-info/licenses/LICENSE,sha256=KjZXYP_CGYzDTtVfcxPT6wlGRoQKHPSJu0vh55_2QSo,1071
-pykdebugparser-1.2.8.dist-info/METADATA,sha256=Y-_cCRLJp7PBpFr0u0i4YREvSr0W_9p3RAeVPyHcrkU,18986
-pykdebugparser-1.2.8.dist-info/WHEEL,sha256=qWEHOWeXof9kJLXAXJ1hukQ_MvVtaV9UUAew6N7Y99E,109
-pykdebugparser-1.2.8.dist-info/entry_points.txt,sha256=NrVIOgPR6v2MbpTZ3aKedP1jQ93nUQus6sgP4wAD0_E,63
-pykdebugparser-1.2.8.dist-info/top_level.txt,sha256=FcHHXR9VKmqufFw0a6UP4c8NyS-u4ORY-yXQ6ZzP_28,15
-pykdebugparser-1.2.8.dist-info/RECORD,,