Package rekall :: Module obj :: Class ProfileModification
[frames] | no frames]

Class ProfileModification

source code


A profile modification adds new types to an existing profile.

A ProfileModification must be invoked explicitely. We have these as plugins
so its easier to find a modification by name. A typical invokation looks
like:

class myPlugin(plugin.Command):
  def __init__(self, **kwargs):
     super(myPlugin, self).__init__(**kwargs)

     # Update the profile with the "VolRegistrySupport" implementation.
     self.profile = obj.ProfileModification.classes[
         'VolRegistrySupport'](self.profile)

Note that this plugin must explicitely apply the correct modification. This
allows the plugin to choose from a number of different implementations. For
example, in the above say we have one implementation (i.e. overlays, object
classes etc) called VolRegistrySupport and another called
ScudetteRegistrySupport, we can choose between them.

Now suppose that ScudetteRegistrySupport introduces an advanced class with
extra methods:

class _CM_KEY_INDEX(obj.Struct):
   .....
   def SpecialMethod(...):
      ....

The plugin relies on using this specific implementation (i.e. if we loaded
the other profile modification, this myPlugin will fail because it will
attempt to call an undefined method!  Essentially by explicitely loading the
modification, the plugin declares that it relies on the
ScudetteRegistrySupport implementation, but does not preclude having another
implementation.

Instance Methods

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __init__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods
 
modify(cls, profile)
This class should modify the profile appropritately.
source code
Static Methods
a new object with type S, a subtype of T
__new__(cls, profile) source code
Properties

Inherited from object: __class__

Method Details

__new__(cls, profile)
Static Method

source code 
Returns: a new object with type S, a subtype of T
Overrides: object.__new__
(inherited documentation)

modify(cls, profile)
Class Method

source code 
This class should modify the profile appropritately.

The profile will be a copy of the original profile and will be returned
to the class caller.

Args:
   A profile to be modified.