Package rekall :: Module plugin :: Class ProfileCommand

Class ProfileCommand

A baseclass for all commands which require a profile.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugin.Command)
	top_level_class A command can be run from the rekall command line. (Inherited from rekall.plugin.Command)

Instance Methods

__init__(self, profile=None, **kwargs)
Baseclass for all plugins which accept a profile.

source code

__iter__(self)
Make plugins that define collect iterable, as convenience. (Inherited from rekall.plugin.Command)

source code

__repr__(self)
repr(x) (Inherited from rekall.plugin.Command)

source code

__str__(self)
Render into a string using the text renderer. (Inherited from rekall.plugin.Command)

source code

get_plugin(self, name, **kwargs)
Returns an instance of the named plugin. (Inherited from rekall.plugin.Command)

source code

render(self, renderer)
Produce results on the renderer given. (Inherited from rekall.plugin.Command)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

args(cls, metadata)
Declare the command line args this plugin needs.

source code

is_active(cls, session)
Checks we are active.

source code

GetActiveClasses(cls, session)
Return only the active commands based on config. (Inherited from rekall.plugin.Command)

source code

GetPrototype(cls, session)
Return an instance of this plugin with suitable default arguments. (Inherited from rekall.plugin.Command)

source code

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

Class Variables
	PROFILE_REQUIRED = `True`
	classes = `{'AFF4Acquire': <class 'rekall.plugins.tools.aff4acq...` (Inherited from rekall.plugin.Command)
	classes_by_name = `{None: [<class 'rekall.plugins.tools.ipython...` (Inherited from rekall.plugin.Command)
	error_status = `None` hash(x) (Inherited from rekall.plugin.Command)
	interactive = `False` (Inherited from rekall.plugin.Command)
	mode = `None` hash(x) (Inherited from rekall.plugin.Command)
	plugin_feature = `'Command'` (Inherited from rekall.plugin.Command)
	producer = `False` (Inherited from rekall.plugin.Command)

Properties
	name (Inherited from rekall.plugin.Command)
Inherited from `object`: `__class__`

Method Details

args(cls, metadata)
Class Method

source code

Declare the command line args this plugin needs.

Overrides: Command.args: (inherited documentation)

is_active(cls, session)
Class Method

source code

Checks we are active.

This method will be called with the session to check if this specific class is active. This mechanism allows multiple implementations to all share the same name, as long as only one is actually active. For example, we can have a linux, windows and mac version of plugins with the "pslist" name.

This mixin provides the mixed class with a basic is_active() method which honors a mode member defined on the class and all its subclasses. The mode is additive (meaning each class and its subclasses are only active if the mode is active).

Overrides: ModeBasedActiveMixin.is_active: (inherited documentation)

init(self, profile=None, **kwargs)
(Constructor)

source code

Baseclass for all plugins which accept a profile.

Args:
  profile: The kernel profile to use for this command.

Overrides: object.__init__

ImplementationByClass(self, name)
Class Method

source code

Overrides: Command.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: Command.ImplementationByName

Class ProfileCommand

args(cls, metadata) Class Method

is_active(cls, session) Class Method

__init__(self, profile=None, **kwargs) (Constructor)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

args(cls, metadata)
Class Method

is_active(cls, session)
Class Method

init(self, profile=None, **kwargs)
(Constructor)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method