| Trees | Indices | Help |
|
|---|
|
|
Support ESX .vmsn file format. The VMSN file format contains a set of metadata in the form of tags, grouped by groups at the header. There is a lot of metadata but the most interesting metadata for us is the metadata in the "memory" group. The file includes a "memory.Memory" data blob which contains the entire memory snapshot of the running machine. The memory blob is serialized into the file as a single large blob but contains physical memory runs stored back to back inside it. The following tags are used: - memory.regionsCount: Stores the total number of regions. - memory.regionPPN: In an array of physical addresses for each physical memory regions in the virtual machine (in pages). - memory.regionSize: Is the size of each physical memory region (in pages). - memory.regionPageNum: Is the offset into the memory.Memory blob for each region (in pages). This may be omitted if there is only one region.
| Nested Classes | |
|
__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
|
top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
| Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
Inherited from |
|||
| Class Methods | |||
|
|||
|
|||
|
|||
| Class Variables | |
PAGE_MASK = -4096
(Inherited from rekall.addrspace.PagedReader)
|
|
PAGE_SIZE = 4096
(Inherited from rekall.addrspace.PagedReader)
|
|
classes =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
classes_by_name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
order = 10
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
plugin_feature =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
runs = Nonehash(x) (Inherited from rekall.addrspace.RunBasedAddressSpace) |
|
virtualized = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
volatile = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
| Properties | |
|
Inherited from |
| Method Details |
Base is the AS we will be stacking on top of, opts are options which
we may use.
Args:
base: A base address space to stack on top of (i.e. delegate to it for
satisfying read requests).
session: An optional session object.
profile: An optional profile to use for parsing the address space
(e.g. needed for hibernation, crash etc.)
|
|
|
| Trees | Indices | Help |
|
|---|
| Generated by Epydoc 3.0.1 on Mon Oct 9 03:28:01 2017 | http://epydoc.sourceforge.net |