Trees | Indices | Help |
|
---|
|
An address space specifically designed for communicating with WinPmem.
Nested Classes | |
__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
|||
|
|||
|
Class Variables | |
volatile = True
|
|
order = Win32FileAddressSpace.order-5
|
|
FIELDS = ["CR3", "NtBuildNumber", "KernBase", "KDBG"]+ ["KPCR%
|
|
CACHE_SIZE = 10
(Inherited from rekall.addrspace.CachingAddressSpaceMixIn)
|
|
CHUNK_SIZE = 0x1000
(Inherited from rekall.plugins.addrspaces.win32.Win32AddressSpace)
|
|
PAGE_MASK = -4096
(Inherited from rekall.addrspace.PagedReader)
|
|
PAGE_SIZE = 4096
(Inherited from rekall.addrspace.PagedReader)
|
|
classes =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
classes_by_name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
plugin_feature =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
runs = None hash(x) (Inherited from rekall.addrspace.RunBasedAddressSpace) |
|
virtualized = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
Properties | |
Inherited from |
Method Details |
x.__init__(...) initializes x; see help(type(x)) for signature
|
Implement this method if you need to configure the session.
|
Return an address space for filename. |
Implement this if we can map files into this address space.
|
Class Variable Details |
FIELDS
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:28:01 2017 | http://epydoc.sourceforge.net |