Package rekall :: Package plugins :: Package addrspaces :: Module amd64 :: Class VTxPagedMemory

Class VTxPagedMemory

Intel VT-x address space.

Provides an address space that does EPT page translation to provide access to the guest physical address space, thus allowing plugins to operate on a virtual machine running on a host operating system.

This is described in the Intel(R) 64 and IA-32 Architectures Software Developer's Manual Volume 3C: System Programming Guide, Part 3, pages 28-1 to 28-12. This book is available for free at http://www.intel.com/products/processor/manuals/index.htm.

This address space depends on the "ept" parameter. You can use the vmscan plugin to find valid ept values on a physical memory image.

Note that support for AMD's AMD-V address space is untested at the moment.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace)
	top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace)

Instance Methods

__init__(self, ept=None, **kwargs)
Instantiate an Intel 32 bit Address space over the layered AS.

source code

get_pml4(self)
Returns the PML4, the base of the paging tree.

source code

__str__(self)
str(x)

source code

ConfigureSession(self, session_obj)
Implement this method if you need to configure the session. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

__eq__(self, other) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)

source code

__repr__(self)
repr(x) (Inherited from rekall.addrspace.BaseAddressSpace)

source code

__unicode__(self) (Inherited from rekall.addrspace.BaseAddressSpace)

source code

as_assert(self, assertion, error=None)
Duplicate for the assert command (so that optimizations don't disable them) (Inherited from rekall.addrspace.BaseAddressSpace)

source code

close(self) (Inherited from rekall.addrspace.BaseAddressSpace)

source code

describe(self, addr)
Return a string describing an address. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

describe_pte(self, collection, pte_addr, pte_value, vaddr) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemoryPae)

source code

describe_vtop(self, vaddr, collection=None)
Describe the resolution process of a Virtual Address. (Inherited from rekall.plugins.addrspaces.amd64.AMD64PagedMemory)

source code

end(self) (Inherited from rekall.plugins.addrspaces.amd64.AMD64PagedMemory)

source code

get_address_ranges(self, start=0, end=4503599627370495)
Generates the runs which fall between start and end. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

get_file_address_space(self, filename)
Implement this to return an address space for filename. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

get_mapped_offset(self, filename, offset)
Implement this if we can map files into this address space. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

get_mappings(self, start=0, end=18446744073709551616)
Enumerate all available ranges. (Inherited from rekall.plugins.addrspaces.amd64.AMD64PagedMemory)

source code

is_valid_address(self, addr)
Tell us if the address is valid (Inherited from rekall.addrspace.PagedReader)

source code

merge_base_ranges(self, start=0, end=4503599627370495)
Generates merged address ranges from get_mapping(). (Inherited from rekall.addrspace.BaseAddressSpace)

source code

read(self, addr, length)
Read 'length' bytes from the virtual address 'vaddr'. (Inherited from rekall.addrspace.PagedReader)

source code

read_pte(self, addr, collection=None)
Returns an unsigned 64-bit integer from the address addr in physical memory. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemoryPae)

source code

vtop(self, vaddr)
Translates virtual addresses into physical offsets. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)

source code

vtop_run(self, addr)
Returns a Run object describing where addr can be read from. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)

source code

write(self, addr, buf)
Write to the address space, if writable. (Inherited from rekall.addrspace.PagedReader)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

metadata(cls, name, default=None)
Obtain metadata about this address space. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

Class Variables
	order = `110`
	valid_mask = `7`
	virtualized = `True`
	PAGE_MASK = `-4096` (Inherited from rekall.addrspace.PagedReader)
	PAGE_SIZE = `4096` (Inherited from rekall.addrspace.PagedReader)
	classes = `{'AFF4AddressSpace': <class 'rekall.plugins.addrspac...` (Inherited from rekall.addrspace.BaseAddressSpace)
	classes_by_name = `{'': [<class 'rekall.addrspace.BufferAddress...` (Inherited from rekall.addrspace.BaseAddressSpace)
	name = `''` (Inherited from rekall.addrspace.BaseAddressSpace)
	plugin_feature = `'BaseAddressSpace'` (Inherited from rekall.addrspace.BaseAddressSpace)
	volatile = `False` (Inherited from rekall.addrspace.BaseAddressSpace)

Properties
	ept
Inherited from `object`: `__class__`

Method Details

init(self, ept=None, **kwargs)
(Constructor)

source code

Instantiate an Intel 32 bit Address space over the layered AS.

Args:
  dtb: The dtb address.

Overrides: object.__init__: (inherited documentation)

get_pml4(self)

source code

Returns the PML4, the base of the paging tree.

Overrides: AMD64PagedMemory.get_pml4: (inherited documentation)

str(self)
(Informal representation operator)

source code

str(x)

Overrides: object.__str__: (inherited documentation)

ImplementationByClass(self, name)
Class Method

source code

Overrides: addrspace.BaseAddressSpace.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: addrspace.BaseAddressSpace.ImplementationByName

Property Details

ept

Get Method:: unreachable.ept(self)

Class VTxPagedMemory

__init__(self, ept=None, **kwargs) (Constructor)

get_pml4(self)

__str__(self) (Informal representation operator)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

ept

init(self, ept=None, **kwargs)
(Constructor)

str(self)
(Informal representation operator)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method