Trees | Indices | Help |
|
---|
|
An address space which uses a list of runs to specify a mapping. This essentially delegates certain address ranges to other address spaces "mapped" into this address space. The runs are tuples of this form: (virtual_address, physical_address, length, address_space) - Virtual Address - An address in this address space's virtual address space. - Physical Address - An address in the delegate address space. - Length - The length of the mapped region. - Address space - the address space that should be read for this region. Note that the physical address above refers to addresses in this delegate address space.
Nested Classes | |
__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
|||
|
|||
|
Class Variables | |
runs = None hash(x) |
|
PAGE_MASK = -4096
(Inherited from rekall.addrspace.PagedReader)
|
|
PAGE_SIZE = 4096
(Inherited from rekall.addrspace.PagedReader)
|
|
classes =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
classes_by_name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
order = 10
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
plugin_feature =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
virtualized = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
volatile = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
Properties | |
Inherited from |
Method Details |
Base is the AS we will be stacking on top of, opts are options which we may use. Args: base: A base address space to stack on top of (i.e. delegate to it for satisfying read requests). session: An optional session object. profile: An optional profile to use for parsing the address space (e.g. needed for hibernation, crash etc.)
|
Returns a Run object describing where addr can be read from.
|
Returns the physical address for this virtual address. Note that this does not mean much without also knowing the address space to read from. Maybe we need to change this method's prototype?
|
Tell us if the address is valid
|
Yields the mappings. Yields: A seqence of Run objects representing each run.
|
|
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:27:49 2017 | http://epydoc.sourceforge.net |