Package rekall :: Package plugins :: Package addrspaces :: Module mips :: Class MIPS32PagedMemory
[frames] | no frames]

Class MIPS32PagedMemory

source code



Address space to handle the MIPS Linux memory layout, which is:

0x0000 0000 - 0x7FFF FFFF  kuseg: User mapped pages
0x8000 0000 - 0x9FFF FFFF  k0seg: Kernel non paged memory, this maps to
                                  address range 0x0000 0000 - 0x1FFF FFFF
0xA000 0000 - 0xBFFF FFFF  k1seg: Kernel non paged, non cached memory,
                                  this maps to address range
                                  0x0000 0000 - 0x1FFF FFFF
0xC000 0000 - 0xFFFF FFFF  k2seg: Kernel paged memory using init_mm.pgd

See page 8 on:
  http://www.eecs.harvard.edu/~margo/cs161/notes/vm-mips.pdf

Derives from IA32PagedMemory as the only major difference is the special
layout as shown above and minor details like no large pages and a difference
in the PTE to PFN translation, which is taken care of by the
pte_paddr function.

Nested Classes
  __metaclass__
Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace)
  top_level_class
This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace)
Instance Methods
 
page_size_flag(self, entry)
MIPS32 doesn't have a page size flag, always return False
source code
 
read_long_phys(self, addr)
Returns an unsigned 32-bit integer from the address addr in physical memory.
source code
 
vtop(self, vaddr)
Translates virtual addresses into physical offsets.
source code
 
pte_paddr(self, pte)
Return the physical address for the given PTE.
source code
 
get_phys_addr(self, vaddr, pte_value)
Return the offset in a 4KB memory page from the given virtual address and Page Table Entry.
source code
 
get_available_addresses(self, start=0)
Enumerate all valid memory ranges.
source code
 
ConfigureSession(self, session_obj)
Implement this method if you need to configure the session. (Inherited from rekall.addrspace.BaseAddressSpace)
source code
 
__eq__(self, other) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory) source code
 
__init__(self, name=None, dtb=None, **kwargs)
Instantiate an Intel 32 bit Address space over the layered AS. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
source code
 
__repr__(self)
repr(x) (Inherited from rekall.addrspace.BaseAddressSpace)
source code
 
__str__(self)
str(x) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
source code
 
__unicode__(self) (Inherited from rekall.addrspace.BaseAddressSpace) source code
 
as_assert(self, assertion, error=None)
Duplicate for the assert command (so that optimizations don't disable them) (Inherited from rekall.addrspace.BaseAddressSpace)
source code
 
close(self) (Inherited from rekall.addrspace.BaseAddressSpace) source code
 
describe(self, addr)
Return a string describing an address. (Inherited from rekall.addrspace.BaseAddressSpace)
source code
 
describe_pte(self, collection, pte_addr, pte_value, vaddr) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory) source code
 
describe_vtop(self, vaddr, collection=None)
A generator of descriptive statements about stages in translation. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
source code
 
end(self) (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory) source code
 
get_address_ranges(self, start=0, end=4503599627370495)
Generates the runs which fall between start and end. (Inherited from rekall.addrspace.BaseAddressSpace)
source code
 
get_file_address_space(self, filename)
Implement this to return an address space for filename. (Inherited from rekall.addrspace.BaseAddressSpace)
source code
 
get_mapped_offset(self, filename, offset)
Implement this if we can map files into this address space. (Inherited from rekall.addrspace.BaseAddressSpace)
source code
 
get_mappings(self, start=0, end=18446744073709551616)
Enumerate all valid memory ranges. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
source code
 
is_valid_address(self, addr)
Tell us if the address is valid (Inherited from rekall.addrspace.PagedReader)
source code
 
merge_base_ranges(self, start=0, end=4503599627370495)
Generates merged address ranges from get_mapping(). (Inherited from rekall.addrspace.BaseAddressSpace)
source code
 
read(self, addr, length)
Read 'length' bytes from the virtual address 'vaddr'. (Inherited from rekall.addrspace.PagedReader)
source code
 
read_pte(self, addr, collection=None)
Read an unsigned 32-bit integer from physical memory. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
source code
 
vtop_run(self, addr)
Returns a Run object describing where addr can be read from. (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
source code
 
write(self, addr, buf)
Write to the address space, if writable. (Inherited from rekall.addrspace.PagedReader)
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods
 
ImplementationByClass(self, name) source code
 
ImplementationByName(self, name) source code
 
metadata(cls, name, default=None)
Obtain metadata about this address space. (Inherited from rekall.addrspace.BaseAddressSpace)
source code
Class Variables
  valid_mask = 4294967295
  PAGE_MASK = -4096 (Inherited from rekall.addrspace.PagedReader)
  PAGE_SIZE = 4096 (Inherited from rekall.addrspace.PagedReader)
  classes = {'AFF4AddressSpace': <class 'rekall.plugins.addrspac... (Inherited from rekall.addrspace.BaseAddressSpace)
  classes_by_name = {'': [<class 'rekall.addrspace.BufferAddress... (Inherited from rekall.addrspace.BaseAddressSpace)
  name = '' (Inherited from rekall.addrspace.BaseAddressSpace)
  order = 70 (Inherited from rekall.plugins.addrspaces.intel.IA32PagedMemory)
  plugin_feature = 'BaseAddressSpace' (Inherited from rekall.addrspace.BaseAddressSpace)
  virtualized = False (Inherited from rekall.addrspace.BaseAddressSpace)
  volatile = False (Inherited from rekall.addrspace.BaseAddressSpace)
Properties

Inherited from object: __class__

Method Details

read_long_phys(self, addr)

source code 

Returns an unsigned 32-bit integer from the address addr in physical memory. If unable to read from that location, returns None.

vtop(self, vaddr)

source code 

Translates virtual addresses into physical offsets. The function should return either None (no valid mapping) or the offset in physical memory where the address maps.

Overrides: addrspace.BaseAddressSpace.vtop

pte_paddr(self, pte)

source code 

Return the physical address for the given PTE.
This should return:
   (pte >> pfn_shift) << page_shift

On MIPS pfn_shift is 11, while page_shift is 12

get_phys_addr(self, vaddr, pte_value)

source code 

Return the offset in a 4KB memory page from the given virtual address and Page Table Entry.

Bits 31:12 are from the PTE Bits 11:0 are from the original linear address

get_available_addresses(self, start=0)

source code 
Enumerate all valid memory ranges.

Yields:
  tuples of (starting virtual address, size) for valid the memory
  ranges.

ImplementationByClass(self, name)
Class Method

source code 
Overrides: addrspace.BaseAddressSpace.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code 
Overrides: addrspace.BaseAddressSpace.ImplementationByName