Package rekall :: Module obj :: Class ListArray

Class ListArray

An array of structs which do not all have the same size.

Nested Classes
	__metaclass__ Give each object a unique ID. (Inherited from rekall.obj.BaseObject)

Instance Methods

__init__(self, maximum_size=None, maximum_offset=None, **kwargs)
Constructor.

source code

__len__(self)
It is generally too expensive to rely on the count of this array.

source code

__iter__(self)

source code

__getitem__(self, pos)

source code

GetData(self)
Returns the raw data of this object. (Inherited from rekall.obj.BaseObject)

source code

__dir__(self)
Hide any members with _. (Inherited from rekall.obj.BaseObject)

source code

__eq__(self, other) (Inherited from rekall.obj.Array)

source code

__format__(self, formatspec)
default object formatter (Inherited from rekall.obj.BaseObject)

source code

__hash__(self)
hash(x) (Inherited from rekall.obj.BaseObject)

source code

__nonzero__(self)
This method is called when we test the truth value of an Object. (Inherited from rekall.obj.BaseObject)

source code

__repr__(self)
repr(x) (Inherited from rekall.obj.Array)

source code

__setitem__(self, item, value) (Inherited from rekall.obj.Array)

source code

__str__(self)
str(x) (Inherited from rekall.obj.BaseObject)

source code

__unicode__(self) (Inherited from rekall.obj.Array)

source code

cast(self, type_name=None, vm=None, **kwargs) (Inherited from rekall.obj.BaseObject)

source code

deref(self, vm=None)
An alias for dereference - less to type. (Inherited from rekall.obj.BaseObject)

source code

dereference(self, vm=None) (Inherited from rekall.obj.BaseObject)

source code

is_valid(self) (Inherited from rekall.obj.BaseObject)

source code

m(self, memname) (Inherited from rekall.obj.BaseObject)

source code

proxied(self) (Inherited from rekall.obj.BaseObject)

source code

reference(self)
Produces a pointer to this object. (Inherited from rekall.obj.BaseObject)

source code

v(self, vm=None)
Do the actual reading and decoding of this member (Inherited from rekall.obj.BaseObject)

source code

write(self, value)
Function for writing the object back to disk (Inherited from rekall.obj.BaseObject)

source code

Inherited from object: __delattr__, __getattribute__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

getproperties(cls)
Return all members that are intended to represent some data. (Inherited from rekall.obj.BaseObject)

source code

Class Variables
	obj_name = `<No name>` (Inherited from rekall.obj.BaseObject)
	obj_parent = `<No parent>` (Inherited from rekall.obj.BaseObject)
	obj_producers = `None` hash(x) (Inherited from rekall.obj.BaseObject)
	target_size = `0` (Inherited from rekall.obj.Array)

Properties
	obj_size It is generally too expensive to rely on the size of this array.
	indices Returns (usually 1) representation(s) of self usable as dict keys. (Inherited from rekall.obj.BaseObject)
	obj_end (Inherited from rekall.obj.BaseObject)
	parents Returns all the parents of this object. (Inherited from rekall.obj.BaseObject)
Inherited from `object`: `__class__`

Method Details

init(self, maximum_size=None, maximum_offset=None, **kwargs)
(Constructor)

source code

Constructor.

This array may be initialized using one of the following parameters:

maximum_size: The maximum size of the array in bytes.
maximum_offset: If we reach this offset iteration is terminated.
count: The total count of items in this list.

max_count: The maximum size of the array. This is a safety mechanism if
  count is calculated. max_count should be set to an upper bound on the
  size of the array.