Package rekall :: Module plugin :: Class Command

Class Command

A command can be run from the rekall command line.

Commands can be automatically imported into the shell's namespace and are expected to produce textual (or other) output.

In order to define a new command simply extend this class.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses.
	top_level_class A command can be run from the rekall command line.

Instance Methods

__init__(self, ignore_required=False, **kwargs)
The constructor for this command.

source code

get_plugin(self, name, **kwargs)
Returns an instance of the named plugin.

source code

__str__(self)
Render into a string using the text renderer.

source code

__repr__(self)
repr(x)

source code

__iter__(self)
Make plugins that define collect iterable, as convenience.

source code

render(self, renderer)
Produce results on the renderer given.

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

args(cls, parser)
Declare the command line args this plugin needs.

source code

GetPrototype(cls, session)
Return an instance of this plugin with suitable default arguments.

source code

GetActiveClasses(cls, session)
Return only the active commands based on config.

source code

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

is_active(cls, session)
Checks we are active. (Inherited from rekall.plugin.ModeBasedActiveMixin)

source code

Class Variables
	interactive = `False`
	producer = `False`
	error_status = `None` hash(x)
	mode = `None` hash(x)
	classes = `{'AFF4Acquire': <class 'rekall.plugins.tools.aff4acq...`
	classes_by_name = `{None: [<class 'rekall.plugins.tools.ipython...`
	plugin_feature = `'Command'`

Properties
	name
Inherited from `object`: `__class__`

Method Details

GetPrototype(cls, session)
Class Method

source code

Return an instance of this plugin with suitable default arguments.

In most general applications, types are declared at compile time and
remain immutable, or at least available throughout the program's
lifecycle. Rekall, on the other hand, leave many of the decisions
usually made at type declaration time until late in the runtime,
when the profile data is available. For this reason, in many of the
cases when other applications would interrogate classes (for attributes
and properties, among other things), in Rekall we must interrogate
their instances, which have access to profile data. In order to
make this possible slightly earlier in the runtime than when running
the plugin, we introduce the concept of prototypes, which are
instances of the plugin or struct with the current session and profile
available, but with no data or arguments set.

Arguments:
    session

Returns:
    And instance of this Command with suitable default arguments.

init(self, ignore_required=False, **kwargs)
(Constructor)

source code

The constructor for this command.

Commands can take arbitrary named args and have access to the running
session.

Args:
  session: The session we will use. Many options are taken from the
    session by default, if not provided. This allows users to omit
    specifying many options.

  ignore_required: If this is true plugin constructors must allow the
    plugin to be instantiated with no parameters. All parameter
    validation shall be disabled and construction must succeed.

Overrides: object.__init__

get_plugin(self, name, **kwargs)

source code

Returns an instance of the named plugin.

The new plugin will initialized with the current session and optional
kwargs.
Args:
  name: The generic name of the plugin (i.e. the __name attribute,
     e.g. pslist).
  kwargs: Extra args to use for instantiating the plugin.

str(self)
(Informal representation operator)

source code

Render into a string using the text renderer.

Overrides: object.__str__

repr(self)
(Representation operator)

source code

repr(x)

Overrides: object.__repr__: (inherited documentation)

iter(self)

source code

Make plugins that define collect iterable, as convenience.

Because this:
    for x in session.plugins.get_some_data():
        # do stuff

Is nicer than this:
    for x in session.plugins.get_some_data().collect():
        # do stuff

render(self, renderer)

source code

Produce results on the renderer given.

Each plugin should implement this method to produce output on the
renderer. The framework will initialize the plugin and provide it with
some kind of renderer to write output on. The plugin should not assume
that the renderer is actually TextRenderer, only that the methods
defined in the BaseRenderer exist.

Args:
  renderer: A renderer based at rekall.ui.renderer.BaseRenderer.

Class Variable Details

classes

Value:

{'AFF4Acquire': <class 'rekall.plugins.tools.aff4acquire.AFF4Acquire'>
,
 'AFF4Dump': <class 'rekall.plugins.tools.aff4acquire.AFF4Dump'>,
 'AFF4Export': <class 'rekall.plugins.tools.aff4acquire.AFF4Export'>,
 'AFF4Ls': <class 'rekall.plugins.tools.aff4acquire.AFF4Ls'>,
 'APIGenerator': <class 'rekall.plugins.common.api.APIGenerator'>,
 'APILsof': <class 'rekall.plugins.response.processes.APILsof'>,
 'APIPslist': <class 'rekall.plugins.response.processes.APIPslist'>,
...

classes_by_name

Value:

{None: [<class 'rekall.plugins.tools.ipython.BaseSessionCommand'>,
        <class 'rekall.plugins.tools.profile_tool_test.BuildIndexTeste
r'>],
 'address_resolver': [<class 'rekall.plugins.response.linux.LinuxAPIAd
dressResolver'>,
                      <class 'rekall.plugins.windows.address_resolver.
WindowsAddressResolver'>,
                      <class 'rekall.plugins.windows.address_resolver.
...

Property Details

name

Get Method:: unreachable.name(cls)

Class Command

GetPrototype(cls, session) Class Method

__init__(self, ignore_required=False, **kwargs) (Constructor)

get_plugin(self, name, **kwargs)

__str__(self) (Informal representation operator)

__repr__(self) (Representation operator)

__iter__(self)

render(self, renderer)

classes

classes_by_name

name

GetPrototype(cls, session)
Class Method

init(self, ignore_required=False, **kwargs)
(Constructor)

str(self)
(Informal representation operator)

repr(self)
(Representation operator)

iter(self)