performance: use the global symbols.

instead of reloading them all the time.  parsing all that dwarf
stuff turns out to be pretty slow, so this is much better for us.
command: cache the address-sorted symbol list.

instead of recalculating it every call.
try a bit harder to find the return address.

before resorting to the heavy-handed and often-problematic
approach of searching through the instruction stream for the next
'ret'.  The search tends to work poorly because our symbol list is
not guaranteed to be perfect.  This is an issue because we try to
search from the start of the function we are in, not the current
instruction we are at (in case the return is above is in the
function), and if we think we are in the wrong function then,
well, we can find the wrong 'return' (or even not find one at
all).
add a readme for our test programs.
stop copying data from the ptrace Read.
more hacks for 'which functions are interesting'.

this approach is flawed.  we need it right now, however, perhaps
because we're catching all accesses of heap memory.  We should
really be filtering things so that, for example, we don't look at
memory that 'fopen' allocates internally.  Thresholding whether or
not we watch memory based on how large the allocation was is
probably also very useful.  Data assigned into a 'char*' is
probably similarly useless: we don't care what strings the user
code handles.

Once we start accurately restricting ourselves to memory regions
that are actually of relevance, it should lower the accesses we
see.  With that restriction, we probably won't need to rely so
heavily on this kind of filtering (though I don't see how we'd
ever be able to remove it outright).
bfd: Make sure we ignore hdf5's "malloc".

Why it even exists is beyond me, but anyway, if we use it we then
of course get the wrong address for 'malloc' and then nothing
works, so make sure to ignore it.
bfd: add many 'base' libraries to the set of libraries we'll load.

getting accurate symbols is important in a couple places.  if we
skip loading a library or 10, then we could associate an
instruction's address with the wrong function.