Trees | Indices | Help |
|
---|
|
1 # Rekall Memory Forensics 2 # Copyright (C) 2012 3 # Copyright 2013 Google Inc. All Rights Reserved. 4 # 5 # Authors: 6 # Michael Cohen <scudette@users.sourceforge.net> 7 # 8 # This program is free software; you can redistribute it and/or modify 9 # it under the terms of the GNU General Public License as published by 10 # the Free Software Foundation; either version 2 of the License, or (at 11 # your option) any later version. 12 # 13 # This program is distributed in the hope that it will be useful, but 14 # WITHOUT ANY WARRANTY; without even the implied warranty of 15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 # General Public License for more details. 17 # 18 # You should have received a copy of the GNU General Public License 19 # along with this program; if not, write to the Free Software 20 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 # 22 23 """ These are standard address spaces supported by Rekall Memory Forensics """ 24 25 import mmap 26 import os 27 28 from rekall import addrspace 29 3032 """ This is an AS which uses an mmap of a file. 33 34 For this AS to be instantiated, we need 35 36 1) A valid config.LOCATION (starting with file://) 37 38 2) no one else has picked the AS before us 39 40 3) base == self (we dont operate on anyone else so we need to be 41 right at the bottom of the AS stack.) 42 """ 43 # We should be the AS of last resort but before the FileAddressSpace 44 order = 110 45 __image = True 4610748 super(MmapFileAddressSpace, self).__init__(**kwargs) 49 self.as_assert(self.base is self, 'Must be first Address Space') 50 51 path = self.session.GetParameter("filename") or filename 52 self.as_assert(path and os.path.exists(path), 53 'Filename must be specified and exist') 54 55 self.fname = self.name = os.path.abspath(path) 56 self.mode = 'rb' 57 if self.session.GetParameter("writable_physical_memory"): 58 self.mode += '+' 59 60 self.fhandle = open(self.fname, self.mode) 61 self.fhandle.seek(0, 2) 62 self.fsize = self.fhandle.tell() 63 self.offset = 0 64 65 # On 64 bit architectures we can just map the entire image into our 66 # process. Its probably not worth the effort to make it work on 32 bit 67 # systems, which should just fall back to the slightly slower 68 # FileAddressSpace. 69 try: 70 self.map = mmap.mmap(self.fhandle.fileno(), self.fsize, 71 access=mmap.ACCESS_READ) 72 except Exception as e: 73 raise addrspace.ASAssertionError("Unable to mmap: %s" % e)7476 result = "" 77 if addr != None: 78 result = self.map[addr:addr + length] 79 80 return result + addrspace.ZEROER.GetZeros(length - len(result))81 86 91 9597 try: 98 self.map[addr:addr + len(data)] = data 99 except IOError: 100 return 0 101 102 return len(data)103
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:29:37 2017 | http://epydoc.sourceforge.net |