Trees       Indices       Help   
Rekall Memory Forensics
Package rekall :: Package plugins :: Package addrspaces :: Module intel :: Class IA32PagedMemoryPae
[frames] | no frames]

Class IA32PagedMemoryPae

source code

Standard x86 32 bit PAE address space.

Provides an address space for IA32 paged memory, aka the x86 architecture, with Physical Address Extensions (PAE) enabled. Allows callers to map virtual address to offsets in physical memory.

Comments in this class mostly come from the Intel(R) 64 and IA-32 Architectures Software Developer's Manual Volume 3A: System Programming Guide, Part 1, revision 031, pages 4-15 to 4-23. This book is available for free at http://www.intel.com/products/processor/manuals/index.htm. Similar information is also available from Advanced Micro Devices (AMD) at http://support.amd.com/us/Processor_TechDocs/24593.pdf.

This implements the translation described in Section "4.4.2 Linear-Address Translation with PAE Paging".

Nested Classes
  __metaclass__
Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace)
  top_level_class
This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace)
Instance Methods
 
describe_vtop(self, vaddr, collection=None)
Explain how a specific address was translated.		 source code
 
describe_pte(self, collection, pte_addr, pte_value, vaddr) source code
 
read_pte(self, addr, collection=None)
Returns an unsigned 64-bit integer from the address addr in physical memory.		 source code
 
get_mappings(self, start=0, end=18446744073709551616)
A generator of address, length tuple for all valid memory regions.		 source code
 
ConfigureSession(self, session_obj)
Implement this method if you need to configure the session. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
__eq__(self, other) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory) source code
 
__init__(self, name=None, dtb=None, **kwargs)
Instantiate an Intel 32 bit Address space over the layered AS. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)		 source code
 
__repr__(self)
repr(x) (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
__str__(self)
str(x) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)		 source code
 
__unicode__(self) (Inherited from rekall.addrspace.BaseAddressSpace) source code
 
as_assert(self, assertion, error=None)
Duplicate for the assert command (so that optimizations don't disable them) (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
close(self) (Inherited from rekall.addrspace.BaseAddressSpace) source code
 
describe(self, addr)
Return a string describing an address. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
end(self) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory) source code
 
get_address_ranges(self, start=0, end=4503599627370495)
Generates the runs which fall between start and end. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
get_file_address_space(self, filename)
Implement this to return an address space for filename. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
get_mapped_offset(self, filename, offset)
Implement this if we can map files into this address space. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
is_valid_address(self, addr)
Tell us if the address is valid (Inherited from rekall.addrspace.PagedReader)		 source code
 
merge_base_ranges(self, start=0, end=4503599627370495)
Generates merged address ranges from get_mapping(). (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
read(self, addr, length)
Read 'length' bytes from the virtual address 'vaddr'. (Inherited from rekall.addrspace.PagedReader)		 source code
 
vtop(self, vaddr)
Translates virtual addresses into physical offsets. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)		 source code
 
vtop_run(self, addr)
Returns a Run object describing where addr can be read from. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)		 source code
 
write(self, addr, buf)
Write to the address space, if writable. (Inherited from rekall.addrspace.PagedReader)		 source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods
 
ImplementationByClass(self, name) source code
 
ImplementationByName(self, name) source code
 
metadata(cls, name, default=None)
Obtain metadata about this address space. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
Class Variables
  order = 80
  PAGE_MASK = -4096 (Inherited from rekall.addrspace.PagedReader)
  PAGE_SIZE = 4096 (Inherited from rekall.addrspace.PagedReader)
  classes = {'AFF4AddressSpace': <class 'rekall.plugins.addrspac... (Inherited from rekall.addrspace.BaseAddressSpace)
  classes_by_name = {'': [<class 'rekall.addrspace.BufferAddress... (Inherited from rekall.addrspace.BaseAddressSpace)
  name = '' (Inherited from rekall.addrspace.BaseAddressSpace)
  plugin_feature = 'BaseAddressSpace' (Inherited from rekall.addrspace.BaseAddressSpace)
  valid_mask = 1 (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
  virtualized = False (Inherited from rekall.addrspace.BaseAddressSpace)
  volatile = False (Inherited from rekall.addrspace.BaseAddressSpace)
Properties

Inherited from object: __class__

Method Details

describe_vtop(self, vaddr, collection=None)

source code  
Explain how a specific address was translated.

Returns:
  a list of AddressTranslationDescriptor() instances.
Overrides: IA32PagedMemory.describe_vtop

describe_pte(self, collection, pte_addr, pte_value, vaddr)

source code 
Overrides: IA32PagedMemory.describe_pte

read_pte(self, addr, collection=None)

source code 

Returns an unsigned 64-bit integer from the address addr in physical memory. If unable to read from that location, returns None.

Overrides: IA32PagedMemory.read_pte

get_mappings(self, start=0, end=18446744073709551616)

source code 

A generator of address, length tuple for all valid memory regions.

Overrides: addrspace.BaseAddressSpace.get_mappings

ImplementationByClass(self, name)
Class Method

source code 
Overrides: addrspace.BaseAddressSpace.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code 
Overrides: addrspace.BaseAddressSpace.ImplementationByName

   Trees       Indices       Help   
Rekall Memory Forensics
Generated by Epydoc 3.0.1 on Mon Oct 9 03:27:59 2017 http://epydoc.sourceforge.net