Class Pointer

Constructor.

Args:
   target: The name of the target object (A string). We use the profile
     to instantiate it.
   target_args: The target will receive these as kwargs.

Overrides: object.__init__

Do the actual reading and decoding of this member

When vm is specified, we are asked to evaluate this object is another address space than the one it was created on. Derived classes should allow for this.

Overrides: BaseObject.v

(inherited documentation)

Overrides: BaseObject.m

Writes the data back into the address space

Overrides: BaseObject.write

(inherited documentation)

Overrides: BaseObject.__eq__

Returns if what we are pointing to is valid

Overrides: BaseObject.is_valid

Indexing a pointer indexes its target.

Note this is different than C which treats pointers as arrays:

struct foobar *p1; struct foobar *p2[];

In C: p[1] -> struct foobar p[2] -> struct foobar *

In Rekall: p[1] -> Not allowed since structs do not have []. p[2] -> struct foobar.

Overrides: BaseObject.dereference

Hide any members with _.

Overrides: BaseObject.__dir__

(inherited documentation)

Overrides: NativeType.cdecl

This method is used in comparison operations.

This ideas here is to make it possible to easily write a condition such
as:

while ptr:
   ...
   ptr += 1

Pointers are considered non-zero if they are invalid (i.e. what they
point to is not mapped in. This is very subtle and might be the wrong
choice. Note that if the kernel actually maps the zero page in (which
can happen in some situations), then a null pointer is actually valid.

Overrides: BaseObject.__nonzero__

Return a new pointer advanced by this many positions.

Note that as usual for pointer arithmetic, the pointer moves by steps of the size of the target.

Overrides: NumericProxyMixIn.__add__

Overrides: NumericProxyMixIn.__sub__

repr(x)

Overrides: object.__repr__

(inherited documentation)

Overrides: BaseObject.__unicode__

Dereference ourselves into another type, or address space.

This method allows callers to explicitly override the setting in the
profile for this pointer.

Args:
  target: The target to override.
  target_args: The args to instantiate this target with.
  vm: The address space to dereference the pointer in.
  profile: If a new profile should be used to instantiate the target.

obj_size

Get Method:

unreachable.obj_size(self)

indices

Returns (usually 1) representation(s) of self usable as dict keys.

Using full base objects for indexing can be slow, especially with Structs. This method returns a representation of the object that is a suitable key - either the value of a primitive type, or the memory address of the more complex ones.

Get Method:

unreachable.indices(self)