Exceptions

The debugger has two exception related controls. Firstly, you can enable or disable exception trapping. Some python modules generate a large number of exceptions in the normal course of execution (the 4Suite XML library is a case in point), which means that debugging any code which makes use of such libraries can be near-impossible if exceptions are enabled.

On the other hand, it may well be the case that exceptions which occur in a Rekall python script really do represent errors. The screenshot above showed an example of this. The name bblock is a mistyping of block, and when the code is executed python raises an error because no variable called bblock exists. If this exception is not caught, then Rekall will detect the error (since control exits from an event function due to the exception) but is limited in what information it can report. Also, you would probably like the debugger to halt execution at the offending line.

The exception skip list provides a means to handle this situation. The skip list consists of a list of exception name prefixs; if an exception occurs but one of the entries in the skip list is a prefix of the exception name (hence xml.dom. is a prefix of xml.dom.scopeError, but not of xml.sax.scopeError) then the debugger does not trap the exception, and python processes the exception as normal.

The exception skip list dialog is shown below. The second entry, xml.dom. is actually superfluous, since xml. will includes all these. The re. prefix skips exceptions from the re package.