The Python Debugger

Rekall has a built in Python debugger. This is still under development, but currently it does the standard sort of debugger things, like trapping errors, handling breakpoints, and displaying variables. The debugger window is brought up using the Show Debugger button on the main database window toolbar (the one with the bug on it!)

The screenshot below shows the debugger in action. The left-hand side contains a tabbed area, with tabs which display (from top to bottom) a view onto all python objects (which starts with the module dictionary); a view of all python functions (grouped up by module); current break and watchpoints; and a backtrace. The right-hand side shows the code of a module; the green marker shows the point at which a breakpoint or error occured, while the read markers denote breakpoints. In this case, the code has an error; block has been mistyped as blocK so the Python interpeter has been unable to locate a getNumRows() method.

Usually, the debugger is just a normal window, just like a form or copier window, which the exception that the debugger is always a separate top-level window, whether Rekall is running in SDI mode or MDI mode. However, if a python exception is raised or a breakpoint is hit, the window becomes modal. Effectively, this freezes Rekall at that point until python execution is continued. While you can edit and compile code at this point, you cannot continue execution with the modified code ( Unlike, for instance Access Basic. This is just not possible with python; python is a much more powerful language than Access Basic, but nothing comes for free. )

Also, you cannot directly load code into the debugger edit window. Code automatically appears if an exception occurs and Rekall can determine its location. Otherwise, once the debugger window is on view, go to the list of scripts in the main database window, and right-click on a script; the popup menu will now include an entry to load the script into the debugger. Alternatively, once a script module has been loaded into the Python interpreter, locate something (such as a function) which is in that module in one of the left-hand windows, and right-click; the popup menu will have an option to display the code.

Tool Icon Use
Set exception skip list
Abort execution (raises an exception)
Single step execution
Continue execution
Toggle breakpoint at current line
Enable/disable exception trapping

Breakpoints
Exceptions