Class BaseObject

Constructor for Base object.

Args:
  type_name: The name of the type of this object. This different
     from the class name, since the same class may implement many types
     (e.g. Struct implements every instance in the vtype definition).

  offset: The offset within the address space to this object exists.

  vm: The address space this object uses to read itself from.

  profile: The profile this object may use to dereference other
   types.

  parent: The object which created this object.

  name: The name of this object.

  context: An opaque dict which is passed to all objects created from
    this object. This dict may contain context specific information
    which each derived instance can use.

  kwargs: Arbitrary args this object may accept - these can be passed in
     the vtype language definition.

Overrides: object.__init__

This method is called when we test the truth value of an Object.

In rekall we consider an object to have True truth value only when it is
a valid object. Its possible for example to have a Pointer object which
is not valid - this will have a truth value of False.

You should be testing for validity like this:
if X:
   # object is valid

Do not test for validity like this:

if int(X) == 0:

or

if X is None:
  .....

the later form is not going to work when X is a NoneObject.

hash(x)

Overrides: object.__hash__

(inherited documentation)

Produces a pointer to this object.

This is the same as the C & operator and is the opposite of deref().

Do the actual reading and decoding of this member

When vm is specified, we are asked to evaluate this object is another address space than the one it was created on. Derived classes should allow for this.

str(x)

Overrides: object.__str__

(inherited documentation)

repr(x)

Overrides: object.__repr__

(inherited documentation)

default object formatter

Overrides: object.__format__

(inherited documentation)

obj_size

Get Method:

unreachable.obj_size(self)

obj_end

Get Method:

unreachable.obj_end(self)

parents

Returns all the parents of this object.

Get Method:

unreachable.parents(self) - Returns all the parents of this object.

indices

Returns (usually 1) representation(s) of self usable as dict keys.

Using full base objects for indexing can be slow, especially with Structs. This method returns a representation of the object that is a suitable key - either the value of a primitive type, or the memory address of the more complex ones.

Get Method:

unreachable.indices(self) - Returns (usually 1) representation(s) of self usable as dict keys.