Package rekall :: Package plugins :: Package linux :: Module common :: Class KAllSyms
[frames] | no frames]

Class KAllSyms

source code


A parser for KAllSyms files.

Instance Methods
 
__init__(self, session)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
ObtainSymbols(self)
Obtain symbol names and values for a live machine.
source code
 
parse_data(self, data) source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables
  KALLSYMS_FILE = '/proc/kallsyms'
  KALLSYMS_REGEXP = '(?P<offset>[0-9a-fA-F]+) (?P<type>[a-zA-Z])...
Properties

Inherited from object: __class__

Method Details

__init__(self, session)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__
(inherited documentation)

ObtainSymbols(self)

source code 
Obtain symbol names and values for a live machine.

Yields:
  Tuples of offset, symbol_name, type, module


Class Variable Details

KALLSYMS_REGEXP

Value:
'(?P<offset>[0-9a-fA-F]+) (?P<type>[a-zA-Z]) (?P<symbol>[^ \\t]+)(\\t(\
?P<module>[^ ]+))?$'