| Trees | Indices | Help |
|
|---|
|
|
Address space to handle the MIPS Linux memory layout, which is:
0x0000 0000 - 0x7FFF FFFF kuseg: User mapped pages
0x8000 0000 - 0x9FFF FFFF k0seg: Kernel non paged memory, this maps to
address range 0x0000 0000 - 0x1FFF FFFF
0xA000 0000 - 0xBFFF FFFF k1seg: Kernel non paged, non cached memory,
this maps to address range
0x0000 0000 - 0x1FFF FFFF
0xC000 0000 - 0xFFFF FFFF k2seg: Kernel paged memory using init_mm.pgd
See page 8 on:
http://www.eecs.harvard.edu/~margo/cs161/notes/vm-mips.pdf
Derives from IA32PagedMemory as the only major difference is the special
layout as shown above and minor details like no large pages and a difference
in the PTE to PFN translation, which is taken care of by the
pte_paddr function.
| Nested Classes | |
|
__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
|
top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
| Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
Inherited from |
|||
| Class Methods | |||
|
|||
|
|||
|
|||
| Class Variables | |
valid_mask = 4294967295
|
|
PAGE_MASK = -4096
(Inherited from rekall.addrspace.PagedReader)
|
|
PAGE_SIZE = 4096
(Inherited from rekall.addrspace.PagedReader)
|
|
classes =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
classes_by_name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
order = 70
(Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
|
|
plugin_feature =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
virtualized = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
volatile = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
| Properties | |
|
Inherited from |
| Method Details |
Returns an unsigned 32-bit integer from the address addr in physical memory. If unable to read from that location, returns None. |
Translates virtual addresses into physical offsets. The function should return either None (no valid mapping) or the offset in physical memory where the address maps.
|
Return the physical address for the given PTE. This should return: (pte >> pfn_shift) << page_shift On MIPS pfn_shift is 11, while page_shift is 12 |
Return the offset in a 4KB memory page from the given virtual address and Page Table Entry. Bits 31:12 are from the PTE Bits 11:0 are from the original linear address |
Enumerate all valid memory ranges. Yields: tuples of (starting virtual address, size) for valid the memory ranges. |
|
|
| Trees | Indices | Help |
|
|---|
| Generated by Epydoc 3.0.1 on Mon Oct 9 03:28:00 2017 | http://epydoc.sourceforge.net |