Class BaseAddressSpace

Base is the AS we will be stacking on top of, opts are options which
we may use.

Args:
  base: A base address space to stack on top of (i.e. delegate to it for
      satisfying read requests).

  session: An optional session object.

  profile: An optional profile to use for parsing the address space
      (e.g. needed for hibernation, crash etc.)

Overrides: object.__init__

Duplicate for the assert command (so that optimizations don't disable them)

It had to be called as_assert, since assert is a keyword

Generates a sequence of Run() objects.

Each Run object describes a single range transformation from this
address space to another address space at a potentially different
mapped_offset.

Runs are assumed to not overlap and are generated in increasing order.

Args:
  start: The suggested start address we are interested in. This function
      may omit runs that lie entirely below this start address. Note:
      Runs are not adjusted to begin at the start address - it may be
      possible that this method returns a run which starts earlier than
      the specified start address.

Generates the runs which fall between start and end.

Note that start and end are here specified in the virtual address
space. More importantly this does not say anything about the pages in
the physical address space - just because pages in the virtual address
space are contiguous does not mean they are also contiguous in the
physical address space.

Yields:
  Run objects describing merged virtual address ranges. NOTE: These runs
  do not have file_offset or address_space members since the file_offset
  is not the same across the entire range and therefore it does not make
  sense to directly read the base address space - If you want to do
  this, use merge_base_ranges() instead.

Generates merged address ranges from get_mapping().

This method is subtly different from get_address_ranges in that runs are
contiguous in the base address space, hence the yielded runs have a
valid file_offset member. Callers can safely issue read operations to
the address space.

Yields:
  runs which are contiguous in the base address space. This function
    is designed to produce ranges more optimized for reducing the number
    of read operations from the underlying base address space.

Write to the address space, if writable.

The default behavior is to delegate the write to the base address space.
If an address space has no base then this function will throw an
IOError. Address spaces that actually implement writing should override.

Raises:
    IOError if there is no base address space. Subclasses may raise
        under additional circumstances.

Arguments:
    addr: The address to write at, as understood by this AS (i.e.
        a virtual address for virtual address spaces, physical for
        physical).
    buf: The data to write - most commonly a basestring instance.

Returns:
    Number of bytes written.

str(x)

Overrides: object.__str__

(inherited documentation)

repr(x)

Overrides: object.__repr__

(inherited documentation)

classes

Value:

{'AFF4AddressSpace': <class 'rekall.plugins.addrspaces.aff4.AFF4Addres sSpace'>, 'AMD64PagedMemory': <class 'rekall.plugins.addrspaces.amd64.AMD64Page dMemory'>, 'APIDummyPhysicalAddressSpace': <class 'rekall.plugins.response.commo n.APIDummyPhysicalAddressSpace'>, 'ArmPagedMemory': <class 'rekall.plugins.addrspaces.arm.ArmPagedMemor y'>, ...

classes_by_name

Value:

{'': [<class 'rekall.addrspace.BufferAddressSpace'>, <class 'rekall.session_test.CustomAddressSpace'>, <class 'rekall.addrspace_test.CustomRunsAddressSpace'>, <class 'rekall.plugins.addrspaces.intel.IA32PagedMemory'>, <class 'rekall.plugins.addrspaces.intel.IA32PagedMemoryPae'>, <class 'rekall.plugins.addrspaces.standard.FDAddressSpace'>, <class 'rekall.plugins.addrspaces.standard.FileAddressSpace'>, <class 'rekall.plugins.addrspaces.standard.GlobalOffsetAddressSp ...