#
# This file contains module/functions to either filter in with a whitelist,
# or filter out with a blacklist.  They can be individually specified by
# module name and function name, separated with '!', like so:
#
#   ld-linux-x86-64.so.2!malloc
#   libc.so.6!free
#   ntdll.dll!RtlEnterCriticalSection
#   KERNELBASE.dll!GetLastError
#   ... etc ...
#
# Furthermore, an entire module's functions can be filtered simply by
# writing its name without any function name appended.  For example, putting
# 'KERNEL32.dll' on a line on its own will match all functions defined in
# KERNEL32.dll (note that it is case-sensitive).
#
# Lastly, a collection of functions can be filtered if the star wildcard is
# appended.  For example, 'ntdll.dll!Rtl*' will match all functions from
# ntdll.dll that begin with 'Rtl', including 'RtlEnterCriticalSection',
# 'RtlLeaveCriticalSection', and many, many others.  Note that the star
# _MUST_ appear at the end only!  In other words, only function name prefixes
# are supported; specifying 'mod!prefix*suffix' is not supported.
#
# Note that module-level filtering is more efficient (in terms of speed) than
# filtering by function names.
#


# Add whitelisted module/functions here.  If any entries here are found, then
# *all* blacklist entries are ignored.
[whitelist]
#libc.so.6
#ld-linux-x86-64.so.2

#KERNEL32.dll
#USER32.dll


# Add blacklisted module/functions here.  Note that these are ignored if *any*
# whitelist entries are given above.
[blacklist]
#ld-linux-x86-64.so.2!_*
#ld-linux-x86-64.so.2!__libc_memalign
#ld-linux-x86-64.so.2!_dl_debug_state
#ld-linux-x86-64.so.2!calloc
#ld-linux-x86-64.so.2!malloc
#libc.so.6!__errno_location
#libc.so.6!__getdelim
#libc.so.6!__getpagesize
#libc.so.6!__strcoll_l
#libc.so.6!free
#libc.so.6!malloc
#libc.so.6!memchr
#libc.so.6!memcpy
#libc.so.6!memmem
#libc.so.6!strcoll
#libc.so.6!strdup
#libc.so.6!strlen
#libc.so.6!strstr

#ntdll.dll!Rtl*
#ntdll.dll!bsearch
#ntdll.dll!memcmp
#ntdll.dll!memcpy
#ntdll.dll!memmove
#ntdll.dll!memset
#ntdll.dll!strrchr
#ntdll.dll!RtlActivateActivationContextUnsafeFast
#ntdll.dll!RtlAcquireSRWLockShared
#ntdll.dll!RtlAcquireSRWLockExclusive
#ntdll.dll!RtlAllocateHeap
#ntdll.dll!RtlAppendUnicodeStringToString
#ntdll.dll!RtlAppendUnicodeToString
#ntdll.dll!RtlCompareUnicodeStrings
#ntdll.dll!RtlCopyUnicodeString
#ntdll.dll!RtlDeactivateActivationContextUnsafeFast
#ntdll.dll!RtlDecodeSystemPointer
#ntdll.dll!RtlEnterCriticalSection
#ntdll.dll!RtlEqualUnicodeString
#ntdll.dll!RtlFreeHeap
#ntdll.dll!RtlFreeUnicodeString
#ntdll.dll!RtlImageNtHeaderEx
#ntdll.dll!RtlInitializeCriticalSection
#ntdll.dll!RtlInitializeCriticalSectionEx
#ntdll.dll!RtlInitUnicodeStringEx
#ntdll.dll!RtlLeaveCriticalSection
#ntdll.dll!RtlReleaseSRWLockExclusive
#ntdll.dll!RtlReleaseSRWLockShared
#ntdll.dll!RtlSetLastWin32Error
#ntdll.dll!RtlTryEnterCriticalSection
#ntdll.dll!wcscpy_s
#ntdll.dll!wcsrchr
#ntdll.dll!ZwCallbackReturn
#KERNEL32.dll!FlsGetValue
#KERNEL32.dll!FlsSetValue
#KERNEL32.dll!GetLastError
#KERNEL32.dll!LocalAlloc
#KERNEL32.dll!LocalFree
#KERNEL32.dll!SetLastError
#KERNEL32.dll!TlsGetValue
#KERNEL32.dll!TlsSetValue
#KERNELBASE.dll!FlsGetValue
#KERNELBASE.dll!FlsSetValue
#KERNELBASE.dll!GetLastError
#KERNELBASE.dll!LocalAlloc
#KERNELBASE.dll!LocalFree
#KERNELBASE.dll!SetLastError
#KERNELBASE.dll!TlsGetValue
#KERNELBASE.dll!TlsSetValue
#msvcrt.dll!_lock
#msvcrt.dll!_unlock
#msvcrt.dll!free
#msvcrt.dll!malloc
#msvcrt.dll!memcmp
#msvcrt.dll!memcpy
#msvcrt.dll!memset
