Package rekall :: Package plugins :: Package darwin :: Module checks :: Class DarwinSysctl

Class DarwinSysctl

Dumps the sysctl database.

On OSX the kernel is configured through the sysctl mechanism. This is
analogous to /proc or /sysfs on Linux. The configuration space is broken
into MIBs - or hierarchical namespace.

https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/sysctl.8.html

For example:

net.inet.ip.subnets_are_local
net.inet.ip.ttl
net.inet.ip.use_route_genid

This is implemented via a singly linked list of sysctl_oid structs. The
structs can be on the following types:

- CTLTYPE_INT     means this MIB will handle an int.
- CTLTYPE_STRING  means this MIB will handle a string.
- CTLTYPE_QUAD    means this MIB will handle a long long int.
- CTLTYPE_NODE means this is a node which handles a sublevel of MIBs. It is
  actually a pointer to a new sysctl_oid_list which handles the sublevel.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugin.Command)
	top_level_class A command can be run from the rekall command line. (Inherited from rekall.plugin.Command)

Instance Methods

CheckSysctl(self)

source code

column_types(self)
Returns instances for each column definition.

source code

collect(self)
Collect data that will be passed to renderer.table_row.

source code

__init__(self, *args, **kwargs)
A mixin for plugins which require a valid kernel address space. (Inherited from rekall.plugin.KernelASMixin)

source code

__iter__(self)
Make plugins that define collect iterable, as convenience. (Inherited from rekall.plugin.Command)

source code

__repr__(self)
repr(x) (Inherited from rekall.plugin.Command)

source code

__str__(self)
Render into a string using the text renderer. (Inherited from rekall.plugin.Command)

source code

collect_as_dicts(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column_type(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_plugin(self, name, **kwargs)
Returns an instance of the named plugin. (Inherited from rekall.plugin.Command)

source code

getkeys(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

reflect(self, member) (Inherited from rekall.plugin.TypedProfileCommand)

source code

render(self, renderer, **options) (Inherited from rekall.plugin.TypedProfileCommand)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

GetActiveClasses(cls, session)
Return only the active commands based on config. (Inherited from rekall.plugin.Command)

source code

GetPrototype(cls, session)
Return an instance of this plugin with suitable default arguments. (Inherited from rekall.plugin.Command)

source code

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

args(cls, metadata) (Inherited from rekall.plugin.PhysicalASMixin)

source code

is_active(cls, session)
Checks we are active. (Inherited from rekall.plugin.ProfileCommand)

source code

Class Variables
	table_header = `[{'name': 'name', 'width': 45}, {'name': 'mib',...` hash(x)
	PHYSICAL_AS_REQUIRED = `True` (Inherited from rekall.plugin.PhysicalASMixin)
	PROFILE_REQUIRED = `True` (Inherited from rekall.plugin.ProfileCommand)
	ROW_OPTIONS = `set(['annotation', 'depth', 'hex_width', 'highli...` (Inherited from rekall.plugin.TypedProfileCommand)
	classes = `{'AFF4Acquire': <class 'rekall.plugins.tools.aff4acq...` (Inherited from rekall.plugin.Command)
	classes_by_name = `{None: [<class 'rekall.plugins.tools.ipython...` (Inherited from rekall.plugin.Command)
	error_status = `None` hash(x) (Inherited from rekall.plugin.Command)
	interactive = `False` (Inherited from rekall.plugin.Command)
	mode = `'mode_darwin_memory'` hash(x) (Inherited from rekall.plugins.darwin.common.DarwinOnlyMixin)
	plugin_args = `None` hash(x) (Inherited from rekall.plugin.ArgsParserMixin)
	plugin_feature = `'Command'` (Inherited from rekall.plugin.Command)
	producer = `False` (Inherited from rekall.plugin.Command)
	table_options = `{}` (Inherited from rekall.plugin.TypedProfileCommand)

Properties
	name (Inherited from rekall.plugin.Command)
Inherited from `object`: `__class__`

Method Details

column_types(self)

source code

Returns instances for each column definition.

The actual objects that are returned when the plugin runs are often determined at run time because they depend on the profile loaded.

This method is used in order to introspect the types of each column without actually running the plugin. A plugin must provide an instance for each column without running any code. This allows interospectors to learn about the output format before running the actual plugin.

Note that this method should almost always be overloaded. We try to do our best here but it is not ideal. Ultimately all plugins will override this method and just declare a column_types() method.

Overrides: plugin.TypedProfileCommand.column_types: (inherited documentation)

collect(self)

source code

Collect data that will be passed to renderer.table_row.

Overrides: plugin.TypedProfileCommand.collect: (inherited documentation)

ImplementationByClass(self, name)
Class Method

source code

Overrides: plugin.Command.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: plugin.Command.ImplementationByName

Class Variable Details

table_header

hash(x)

Value:

[{'name': 'name', 'width': 45},
 {'name': 'mib', 'width': 16},
 {'name': 'perms', 'width': 6},
 {'name': 'handler', 'style': 'address'},
 {'name': 'symbol', 'width': 40},
 {'name': 'value'}]

Class DarwinSysctl

column_types(self)

collect(self)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

table_header

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method