Package rekall :: Package plugins :: Package addrspaces :: Module intel :: Class IA32PagedMemory

Class IA32PagedMemory

Standard x86 32 bit non PAE address space.

Provides an address space for IA32 paged memory, aka the x86 architecture, without Physical Address Extensions (PAE). Allows callers to map virtual address to offsets in physical memory.

Create a new IA32 address space without PAE to sit on top of the base address space and a Directory Table Base (CR3 value) of 'dtb'.

Comments in this class mostly come from the Intel(R) 64 and IA-32 Architectures Software Developer's Manual Volume 3A: System Programming Guide, Part 1, revision 031, pages 4-8 to 4-15. This book is available for free at http://www.intel.com/products/processor/manuals/index.htm. Similar information is also available from Advanced Micro Devices (AMD) at http://support.amd.com/us/Processor_TechDocs/24593.pdf.

This address space implements paging as described in section "4.3 32-BIT PAGING" of the above book.

This is simplified from previous versions of rekall, by removing caching and automated DTB searching (which is now performed by specific plugins in an OS specific way).

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace)
	top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace)

Instance Methods

__init__(self, name=None, dtb=None, **kwargs)
Instantiate an Intel 32 bit Address space over the layered AS.

source code

vtop(self, vaddr)
Translates virtual addresses into physical offsets.

source code

vtop_run(self, addr)
Returns a Run object describing where addr can be read from.

source code

describe_vtop(self, vaddr, collection=None)
A generator of descriptive statements about stages in translation.

source code

describe_pte(self, collection, pte_addr, pte_value, vaddr)

source code

read_pte(self, addr, collection=None)
Read an unsigned 32-bit integer from physical memory.

source code

get_mappings(self, start=0, end=18446744073709551616)
Enumerate all valid memory ranges.

source code

__str__(self)
str(x)

source code

__eq__(self, other)

source code

end(self)

source code

ConfigureSession(self, session_obj)
Implement this method if you need to configure the session. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

__repr__(self)
repr(x) (Inherited from rekall.addrspace.BaseAddressSpace)

source code

__unicode__(self) (Inherited from rekall.addrspace.BaseAddressSpace)

source code

as_assert(self, assertion, error=None)
Duplicate for the assert command (so that optimizations don't disable them) (Inherited from rekall.addrspace.BaseAddressSpace)

source code

close(self) (Inherited from rekall.addrspace.BaseAddressSpace)

source code

describe(self, addr)
Return a string describing an address. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

get_address_ranges(self, start=0, end=4503599627370495)
Generates the runs which fall between start and end. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

get_file_address_space(self, filename)
Implement this to return an address space for filename. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

get_mapped_offset(self, filename, offset)
Implement this if we can map files into this address space. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

is_valid_address(self, addr)
Tell us if the address is valid (Inherited from rekall.addrspace.PagedReader)

source code

merge_base_ranges(self, start=0, end=4503599627370495)
Generates merged address ranges from get_mapping(). (Inherited from rekall.addrspace.BaseAddressSpace)

source code

read(self, addr, length)
Read 'length' bytes from the virtual address 'vaddr'. (Inherited from rekall.addrspace.PagedReader)

source code

write(self, addr, buf)
Write to the address space, if writable. (Inherited from rekall.addrspace.PagedReader)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

metadata(cls, name, default=None)
Obtain metadata about this address space. (Inherited from rekall.addrspace.BaseAddressSpace)

source code

Class Variables
	order = `70`
	valid_mask = `1`
	PAGE_MASK = `-4096` (Inherited from rekall.addrspace.PagedReader)
	PAGE_SIZE = `4096` (Inherited from rekall.addrspace.PagedReader)
	classes = `{'AFF4AddressSpace': <class 'rekall.plugins.addrspac...` (Inherited from rekall.addrspace.BaseAddressSpace)
	classes_by_name = `{'': [<class 'rekall.addrspace.BufferAddress...` (Inherited from rekall.addrspace.BaseAddressSpace)
	name = `''` (Inherited from rekall.addrspace.BaseAddressSpace)
	plugin_feature = `'BaseAddressSpace'` (Inherited from rekall.addrspace.BaseAddressSpace)
	virtualized = `False` (Inherited from rekall.addrspace.BaseAddressSpace)
	volatile = `False` (Inherited from rekall.addrspace.BaseAddressSpace)

Properties
Inherited from `object`: `__class__`

Method Details

init(self, name=None, dtb=None, **kwargs)
(Constructor)

source code

Instantiate an Intel 32 bit Address space over the layered AS.

Args:
  dtb: The dtb address.

Overrides: object.__init__

vtop(self, vaddr)

source code

Translates virtual addresses into physical offsets.

The function should return either None (no valid mapping) or the offset in physical memory where the address maps.

This function is simply a wrapper around describe_vtop() which does all the hard work. You probably never need to override it.

Overrides: addrspace.BaseAddressSpace.vtop

vtop_run(self, addr)

source code

Returns a Run object describing where addr can be read from.

Overrides: addrspace.BaseAddressSpace.vtop_run: (inherited documentation)

describe_vtop(self, vaddr, collection=None)

source code

A generator of descriptive statements about stages in translation.

While the regular vtop is called very frequently and therefore must be
fast, this variation is used to examine the translation process in
detail. We therefore emit data about each step of the way - potentially
re-implementing the vtop() method above, but yielding intermediate
results.

Args:
  vaddr: The address to translate.
  collection: An instance of DescriptorCollection() which will receive
    the address descriptors. If not provided we create a new collection.

Returns
  A list of AddressTranslationDescriptor() instances.

read_pte(self, addr, collection=None)

source code

Read an unsigned 32-bit integer from physical memory.

Note this always succeeds - reads outside mapped addresses in the image will simply return 0.

get_mappings(self, start=0, end=18446744073709551616)

source code

Enumerate all valid memory ranges.

Yields:
  tuples of (starting virtual address, size) for valid the memory
  ranges.

Overrides: addrspace.BaseAddressSpace.get_mappings

str(self)
(Informal representation operator)

source code

str(x)

Overrides: object.__str__: (inherited documentation)

Class IA32PagedMemory

__init__(self, name=None, dtb=None, **kwargs) (Constructor)

vtop(self, vaddr)

vtop_run(self, addr)

describe_vtop(self, vaddr, collection=None)

read_pte(self, addr, collection=None)

get_mappings(self, start=0, end=18446744073709551616)

__str__(self) (Informal representation operator)

__eq__(self, other) (Equality operator)

end(self)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

init(self, name=None, dtb=None, **kwargs)
(Constructor)

str(self)
(Informal representation operator)

eq(self, other)
(Equality operator)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method