Package rekall :: Package plugins :: Package overlays

Package overlays

Submodules

rekall.plugins.overlays.basic: This file defines some basic types which might be useful for many OS's
rekall.plugins.overlays.darwin: Profiles to support OSX specific data structures.
- rekall.plugins.overlays.darwin.darwin
- rekall.plugins.overlays.darwin.macho: This profile is for the Mach-O file format.
rekall.plugins.overlays.linux: Linux support for DWARF profiles.
- rekall.plugins.overlays.linux.dwarfdump
- rekall.plugins.overlays.linux.dwarfparser: A parser for dwarf modules which generates vtypes.
- rekall.plugins.overlays.linux.elf: This file implements elf file parsing.
- rekall.plugins.overlays.linux.linux
- rekall.plugins.overlays.linux.vfs
rekall.plugins.overlays.native_types: Data types for various compilers.
rekall.plugins.overlays.windows
- rekall.plugins.overlays.windows.common: Common windows overlays and classes.
- rekall.plugins.overlays.windows.crashdump: This file adds support for windows debugging related data.
- rekall.plugins.overlays.windows.heap: The module implements user mode heap overlays.
- rekall.plugins.overlays.windows.kdbg_vtypes
- rekall.plugins.overlays.windows.pe_vtypes: References: http://msdn.microsoft.com/en-us/magazine/ms809762.aspx http://msdn.microsoft.com/en-us/magazine/cc301805.aspx http://code.google.com/p/corkami/downloads/detail?name=pe-20110117.pdf http://code.google.com/p/pefile/
- rekall.plugins.overlays.windows.tcpip_vtypes
- rekall.plugins.overlays.windows.tokens: Classes around handling tokens, privileges etc.
- rekall.plugins.overlays.windows.undocumented: This file contains all the undocumented structs that were derived by reversing.
- rekall.plugins.overlays.windows.vista
- rekall.plugins.overlays.windows.win10
- rekall.plugins.overlays.windows.win7
- rekall.plugins.overlays.windows.win8
- rekall.plugins.overlays.windows.windows
- rekall.plugins.overlays.windows.xp

Variables
	__package__ = `'rekall.plugins.overlays'`