Package rekall :: Package plugins :: Package overlays :: Module basic

Module basic

This file defines some basic types which might be useful for many OS's

Classes
	String Class for dealing with Null terminated C Strings.
	Signature A string forming a signature.
	UnicodeString A class for dealing with encoded text strings.
	Flags This object decodes each flag into a string
	Enumeration Enumeration class for handling multiple meanings for a single value
	Ipv4Address Provides proper output for Ipv4Address objects
	Ipv6Address Provides proper output for Ipv6Address objects
	MacAddress A MAC address.
	ListMixIn A helper for following lists.
	ShiftedTimezone
	UnixTimeStamp A unix timestamp (seconds since the epoch).
	ValueEnumeration An enumeration which receives its value from a callable.
	timeval
	WinFileTime Class for handling Windows Time Stamps
	ThreadCreateTimeStamp Handles ThreadCreateTimeStamps which are bit shifted WinFileTimes
	IndexedArray An array which can be addressed via constant names.
	ProfileMIPS32Bits Basic profile for 32 bit MIPS systems.
	Profile32Bits Basic profile for 32 bit systems.
	ProfileLLP64 Basic profile for 64 bit Windows systems.
	ProfileLP64 Basic profile for 64 bit Linux systems.
	BasicClasses Basic profile which introduces the basic classes.
	RelativeOffsetMixin A mixin which shifts all constant addresses by a constant.

Functions

container_of(ptr, type, member)
cast a member of a structure out to the containing structure.

source code

Variables
	common_overlay = `{'LIST_ENTRY32': [8, {'Blink': [4, ['Pointer3...`
	__package__ = `'rekall.plugins.overlays'`

Function Details

container_of(ptr, type, member)

source code

cast a member of a structure out to the containing structure.

http://lxr.free-electrons.com/source/include/linux/kernel.h?v=3.7#L677

Variables Details

common_overlay

Value:

{'LIST_ENTRY32': [8,
                  {'Blink': [4,
                             ['Pointer32', {'target': 'LIST_ENTRY32'}]
],
                   'Flink': [0,
                             ['Pointer32', {'target': 'LIST_ENTRY32'}]
]}],
 'LIST_ENTRY64': [16, {'Blink': [8, ['pointer', ['LIST_ENTRY64']]], 'F
...