Package rekall :: Package plugins :: Package common :: Package efilter_plugins :: Module search :: Class CommandWrapper

Class CommandWrapper

Wraps a plugin and its output for the purpose of EFILTER searches.

This is a helper class for the Search plugin. It lets us pretend that
plugins are functions to be called from inside EFILTER queries, and also
takes care of running the plugin and saving its output and headers.

Members:
    plugin_cls: The type of the Command subclass.
    rows: Output of rendering the plugin.
    columns: How 'rows' are structured.
    table_header: If Command is a subclass of TypedProfileCommand then this
        will contain its table header once applied.

Instance Methods

__init__(self, plugin_cls, session)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

__repr__(self)
repr(x)

source code

apply(self, args, kwargs)
Instantiate the plugin with given args and run it.

source code

reflect_runtime_return(self)
Return the return type* of this CommandWrapper.

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables
	plugin_cls = `None` hash(x)
	plugin_obj = `None` hash(x)
	rows = `None` hash(x)
	columns = `None` hash(x)
	session = `None` hash(x)

Properties
Inherited from `object`: `__class__`

Method Details

init(self, plugin_cls, session)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

repr(self)
(Representation operator)

source code

repr(x)

Overrides: object.__repr__: (inherited documentation)

apply(self, args, kwargs)

source code

Instantiate the plugin with given args and run it.

This caches the output of the plugin. Subsequently, table_header,
rows and columns will be populated.

The CommmandWrapper must not be applied twice with different
arguments - each instance represents a unique application.

Arguments:
    args, kwargs: Arguments to the plugin.

reflect_runtime_return(self)

source code

Return the return type* of this CommandWrapper.

This actually returns a dummy instance (prototype) of the plugin this CommandWrapper wraps. EFILTER allows use of stand-in objects for type inference. We make heavy use of prototypes to represent Rekall's profile-dependent type system.

Class CommandWrapper

__init__(self, plugin_cls, session) (Constructor)

__repr__(self) (Representation operator)

apply(self, args, kwargs)

reflect_runtime_return(self)

init(self, plugin_cls, session)
(Constructor)

repr(self)
(Representation operator)