Trees | Indices | Help |
|
---|
|
A class splitting an integer into a bunch of bit.
Nested Classes | |
__metaclass__ Give each object a unique ID. (Inherited from rekall.obj.BaseObject) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
Class Variables | |
obj_name = <No name>
(Inherited from rekall.obj.BaseObject)
|
|
obj_parent = <No parent>
(Inherited from rekall.obj.BaseObject)
|
|
obj_producers = None hash(x) (Inherited from rekall.obj.BaseObject) |
Properties | |
obj_size | |
indices Returns (usually 1) representation(s) of self usable as dict keys. (Inherited from rekall.obj.BaseObject) |
|
obj_end (Inherited from rekall.obj.BaseObject) | |
parents Returns all the parents of this object. (Inherited from rekall.obj.BaseObject) |
|
Inherited from |
Method Details |
Constructor for Base object. Args: type_name: The name of the type of this object. This different from the class name, since the same class may implement many types (e.g. Struct implements every instance in the vtype definition). offset: The offset within the address space to this object exists. vm: The address space this object uses to read itself from. profile: The profile this object may use to dereference other types. parent: The object which created this object. name: The name of this object. context: An opaque dict which is passed to all objects created from this object. This dict may contain context specific information which each derived instance can use. kwargs: Arbitrary args this object may accept - these can be passed in the vtype language definition.
|
Do the actual reading and decoding of this member When vm is specified, we are asked to evaluate this object is another address space than the one it was created on. Derived classes should allow for this.
|
Writes the data back into the address space
|
repr(x)
|
This method is called when we test the truth value of an Object. In rekall we consider an object to have True truth value only when it is a valid object. Its possible for example to have a Pointer object which is not valid - this will have a truth value of False. You should be testing for validity like this: if X: # object is valid Do not test for validity like this: if int(X) == 0: or if X is None: ..... the later form is not going to work when X is a NoneObject.
|
Property Details |
obj_size
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:27:52 2017 | http://epydoc.sourceforge.net |