Trees | Indices | Help |
|
---|
|
Hexdump an object or memory location. You can use this plugin repeateadely to keep dumping more data using the "p _" (print last result) operation: In [2]: dump 0x814b13b0, address_space="K" ------> dump(0x814b13b0, address_space="K") Offset Hex Data ---------- ------------------------------------------------ ---------------- 0x814b13b0 03 00 1b 00 00 00 00 00 b8 13 4b 81 b8 13 4b 81 ..........K...K. Out[3]: <rekall.plugins.core.Dump at 0x2967510> In [4]: p _ ------> p(_) Offset Hex Data ---------- ------------------------------------------------ ---------------- 0x814b1440 70 39 00 00 54 1b 01 00 18 0a 00 00 32 59 00 00 p9..T.......2Y.. 0x814b1450 6c 3c 01 00 81 0a 00 00 18 0a 00 00 00 b0 0f 06 l<.............. 0x814b1460 00 10 3f 05 64 77 ed 81 d4 80 21 82 00 00 00 00 ..?.dw....!.....
Nested Classes | |
__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugin.Command) |
|
top_level_class A command can be run from the rekall command line. (Inherited from rekall.plugin.Command) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
Class Variables | |
table_header =
hash(x) |
|
ROW_OPTIONS =
(Inherited from rekall.plugin.TypedProfileCommand)
|
|
classes =
(Inherited from rekall.plugin.Command)
|
|
classes_by_name =
(Inherited from rekall.plugin.Command)
|
|
error_status = None hash(x) (Inherited from rekall.plugin.Command) |
|
interactive = False
(Inherited from rekall.plugin.Command)
|
|
mode = None hash(x) (Inherited from rekall.plugin.Command) |
|
plugin_args = None hash(x) (Inherited from rekall.plugin.ArgsParserMixin) |
|
plugin_feature =
(Inherited from rekall.plugin.Command)
|
|
producer = False
(Inherited from rekall.plugin.Command)
|
|
table_options =
(Inherited from rekall.plugin.TypedProfileCommand)
|
Properties | |
name (Inherited from rekall.plugin.Command) | |
Inherited from |
Method Details |
Returns instances for each column definition. The actual objects that are returned when the plugin runs are often determined at run time because they depend on the profile loaded. This method is used in order to introspect the types of each column without actually running the plugin. A plugin must provide an instance for each column without running any code. This allows interospectors to learn about the output format before running the actual plugin. Note that this method should almost always be overloaded. We try to do our best here but it is not ideal. Ultimately all plugins will override this method and just declare a column_types() method.
|
x.__init__(...) initializes x; see help(type(x)) for signature
|
Collect data that will be passed to renderer.table_row.
|
|
|
Class Variable Details |
table_headerhash(x)
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:28:05 2017 | http://epydoc.sourceforge.net |