Package rekall :: Package plugins :: Package darwin :: Module common

[frames] | no frames]

Module common

Author: Michael Cohen <scudette@google.com>

Classes
	DarwinOnlyMixin Every Darwin-only plugin or hook will have this mixin in their MRO.
	AbstractDarwinParameterHook Base class for session parameter hooks on Darwin.
	AbstractDarwinCommand Base class for Darwin profile commands.
	AbstractDarwinProducer Base class for Darwin producers using the physical AS.
	AbstractDarwinCachedProducer Base class for Darwin producers backed by a session param hook.
	KernelSlideHook Find the kernel slide if needed.
	CatfishScanner
	CatfishOffsetHook Find the actual offset of the _lowGlo struct.
	DarwinKASLRMixin Ensures that KASLR slide is computed and stored in the session.
	DarwinFindKASLR A scanner for KASLR slide values in the Darwin kernel.
	DarwinFindDTB Tries to find the DTB address for the Darwin/XNU kernel.
	ProcessFilterMixin Adds methods and arguments that enable easy fitlering by process.
	KernelAddressCheckerMixIn A plugin mixin which does kernel address checks.

Functions

ID_MAP_VTOP(x)

source code

Variables
	LOW_4GB_MASK = `4294967295`
	KERNEL_MIN_ADDRESS = `18446743523953737728`
	X64_POINTER_MASK = `281474976710655`
	__package__ = `'rekall.plugins.darwin'`