Trees | Indices | Help |
|
---|
|
Specialized address space for internal use.
Provides transparent reads through to a string buffer, so that profile types can be instantiated on top of strings.
Nested Classes | |
__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
|||
|
|||
|
Class Variables | |
classes =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
classes_by_name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
order = 10
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
plugin_feature =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
virtualized = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
volatile = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
Properties | |
writable Buffer AS is always writable, no matter what the session says. |
|
Inherited from |
Method Details |
Base is the AS we will be stacking on top of, opts are options which we may use. Args: base: A base address space to stack on top of (i.e. delegate to it for satisfying read requests). session: An optional session object. profile: An optional profile to use for parsing the address space (e.g. needed for hibernation, crash etc.)
|
Tell us if the address is valid
|
Should be overridden by derived classes.
|
Write to the address space, if writable. The default behavior is to delegate the write to the base address space. If an address space has no base then this function will throw an IOError. Address spaces that actually implement writing should override. Raises: IOError if there is no base address space. Subclasses may raise under additional circumstances. Arguments: addr: The address to write at, as understood by this AS (i.e. a virtual address for virtual address spaces, physical for physical). buf: The data to write - most commonly a basestring instance. Returns: Number of bytes written.
|
Generates a sequence of Run() objects. Each Run object describes a single range transformation from this address space to another address space at a potentially different mapped_offset. Runs are assumed to not overlap and are generated in increasing order. Args: start: The suggested start address we are interested in. This function may omit runs that lie entirely below this start address. Note: Runs are not adjusted to begin at the start address - it may be possible that this method returns a run which starts earlier than the specified start address.
|
repr(x)
|
Return the end address of the buffer.
|
|
|
Property Details |
writableBuffer AS is always writable, no matter what the session says.
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:27:48 2017 | http://epydoc.sourceforge.net |