Package rekall :: Package plugins :: Module guess_profile :: Class WindowsRSDSDetector

Class WindowsRSDSDetector

A detection method based on the scanning for RSDS signatures.

Nested Classes
	find_dtb_impl A plugin to search for the Directory Table Base for windows systems.
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugins.guess_profile.DetectionMethod)
	top_level_class A baseclass to implement autodetection methods. (Inherited from rekall.plugins.guess_profile.DetectionMethod)

Instance Methods

__init__(self, **kwargs)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

Keywords(self)
Returns a list of keywords which will be searched.

source code

Offsets(self)
Return a list of offsets we care about.

source code

VerifyProfile(self, profile_name)
Check that the profile name is valid.

source code

DetectFromHit(self, hit, offset, address_space)
Gets called for each hit.

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

Class Variables
	name = `'rsds'` hash(x)
	order = `90`
	KERNEL_NAMES = `set(['ntkrnlmp.pdb', 'ntkrnlpa.pdb', 'ntkrpamp....`
	classes = `{'DarwinIndexDetector': <class 'rekall.plugins.guess...` (Inherited from rekall.plugins.guess_profile.DetectionMethod)
	classes_by_name = `{None: [<class 'rekall.plugins.guess_profile...` (Inherited from rekall.plugins.guess_profile.DetectionMethod)
	plugin_feature = `'DetectionMethod'` (Inherited from rekall.plugins.guess_profile.DetectionMethod)

Properties
Inherited from `object`: `__class__`

Method Details

init(self, **kwargs)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

Keywords(self)

source code

Returns a list of keywords which will be searched.

Each time the keyword is matched, this instance will be called to attempt detection.

Overrides: DetectionMethod.Keywords: (inherited documentation)

Offsets(self)

source code

Return a list of offsets we care about.

Overrides: DetectionMethod.Offsets: (inherited documentation)

VerifyProfile(self, profile_name)

source code

Check that the profile name is valid.

Overrides: DetectionMethod.VerifyProfile: (inherited documentation)

DetectFromHit(self, hit, offset, address_space)

source code

Gets called for each hit.

If a profile matches, return it, otherwise None.

Overrides: DetectionMethod.DetectFromHit: (inherited documentation)

ImplementationByClass(self, name)
Class Method

source code

Overrides: DetectionMethod.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: DetectionMethod.ImplementationByName

Class Variable Details

KERNEL_NAMES

Value:

set(['ntkrnlmp.pdb', 'ntkrnlpa.pdb', 'ntkrpamp.pdb', 'ntoskrnl.pdb'])

Class WindowsRSDSDetector

__init__(self, **kwargs) (Constructor)

Keywords(self)

Offsets(self)

VerifyProfile(self, profile_name)

DetectFromHit(self, hit, offset, address_space)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

KERNEL_NAMES

init(self, **kwargs)
(Constructor)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method