Trees       Indices       Help   
Rekall Memory Forensics
Package rekall :: Package plugins :: Package overlays :: Module basic :: Class Enumeration
[frames] | no frames]

Class Enumeration

source code

Enumeration class for handling multiple meanings for a single value

Nested Classes
  __metaclass__
Give each object a unique ID. (Inherited from rekall.obj.BaseObject)
Instance Methods
 
__init__(self, choices=None, enum_name=None, target='unsigned long', target_args=None, value=None, default=None, **kwargs)
Construct an enumeration instance.		 source code
 
is_valid(self) source code
 
v(self, vm=None)
Do the actual reading and decoding of this member		 source code
 
write(self, data)
Writes the data back into the address space		 source code
 
__hash__(self)
hash(x)		 source code
 
__unicode__(self) source code
 
__eq__(self, other) source code
 
__repr__(self)
repr(x)		 source code
 
__getattr__(self, attr) source code
 
GetData(self)
Returns the raw data of this object. (Inherited from rekall.obj.BaseObject)		 source code
 
__abs__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__add__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__and__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__dir__(self)
Hide any members with _. (Inherited from rekall.obj.BaseObject)		 source code
 
__div__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__divmod__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__float__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__floordiv__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__format__(self, formatspec)
default object formatter (Inherited from rekall.obj.BaseObject)		 source code
 
__ge__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__gt__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__hex__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__index__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__int__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__invert__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__le__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__long__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__lshift__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__lt__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__mod__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__mul__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__ne__(self, other) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__neg__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__nonzero__(self)
This method is called when we test the truth value of an Object. (Inherited from rekall.obj.BaseObject)		 source code
 
__oct__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__or__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__pos__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__pow__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__radd__(self, other) (Inherited from rekall.obj.NativeType) source code
 
__rand__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rdiv__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rdivmod__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rfloordiv__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rlshift__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rmod__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rmul__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__ror__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rpow__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rrshift__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rshift__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rsub__(self, other) (Inherited from rekall.obj.NativeType) source code
 
__rtruediv__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__rxor__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__str__(self)
str(x) (Inherited from rekall.obj.BaseObject)		 source code
 
__sub__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__truediv__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
__xor__(self, *args, **kw) (Inherited from rekall.obj.NumericProxyMixIn) source code
 
cast(self, type_name=None, vm=None, **kwargs) (Inherited from rekall.obj.BaseObject) source code
 
cdecl(self) (Inherited from rekall.obj.NativeType) source code
 
deref(self, vm=None)
An alias for dereference - less to type. (Inherited from rekall.obj.BaseObject)		 source code
 
dereference(self, vm=None) (Inherited from rekall.obj.BaseObject) source code
 
m(self, memname) (Inherited from rekall.obj.BaseObject) source code
 
proxied(self) (Inherited from rekall.obj.NativeType) source code
 
reference(self)
Produces a pointer to this object. (Inherited from rekall.obj.BaseObject)		 source code

Inherited from object: __delattr__, __getattribute__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods
 
getproperties(cls)
Return all members that are intended to represent some data. (Inherited from rekall.obj.BaseObject)		 source code
Class Variables
  obj_name = <No name> (Inherited from rekall.obj.BaseObject)
  obj_parent = <No parent> (Inherited from rekall.obj.BaseObject)
  obj_producers = None
hash(x) (Inherited from rekall.obj.BaseObject)
Properties
  obj_size
  reverse_choices
  indices
Returns (usually 1) representation(s) of self usable as dict keys. (Inherited from rekall.obj.BaseObject)
  obj_end (Inherited from rekall.obj.BaseObject)
  parents
Returns all the parents of this object. (Inherited from rekall.obj.BaseObject)

Inherited from object: __class__

Method Details

__init__(self, choices=None, enum_name=None, target='unsigned long', target_args=None, value=None, default=None, **kwargs)
(Constructor)

source code  
Construct an enumeration instance.

The enumeration is constructed over the top of a target (which is
assumed to produce an integer value). The value of the target is then
looked up in the choices. Note that the enumeration is treated as an
integer.

Args:
  choices: A dict of int values (keys) and names (values).

  enum_name: If provided, the choices dict is retrieved from the
    profile's constant area. This avoids the profile generator from
    having to make copies of the enum choices for each field which uses
    the same enum.

  target: The target type which we overlay on.

  value: Usually the value is parsed from the address space, but if the
    value parameter is provided, we initialize from this value.

  default: If the underlying integer does not appear in the choices
    dict, we use this default value.
Overrides: object.__init__

is_valid(self)

source code 
Overrides: obj.BaseObject.is_valid

v(self, vm=None)

source code 

Do the actual reading and decoding of this member

When vm is specified, we are asked to evaluate this object is another address space than the one it was created on. Derived classes should allow for this.

Overrides: obj.BaseObject.v
(inherited documentation)

write(self, data)

source code 

Writes the data back into the address space

Overrides: obj.BaseObject.write
(inherited documentation)

__hash__(self)
(Hashing function)

source code 

hash(x)

Overrides: object.__hash__
(inherited documentation)

__unicode__(self)

source code 
Overrides: obj.BaseObject.__unicode__

__eq__(self, other)
(Equality operator)

source code 
Overrides: obj.BaseObject.__eq__

__repr__(self)
(Representation operator)

source code 

repr(x)

Overrides: object.__repr__
(inherited documentation)

Property Details

obj_size

Get Method:
unreachable.obj_size(self)

reverse_choices

Get Method:
unreachable.reverse_choices(self)

   Trees       Indices       Help   
Rekall Memory Forensics
Generated by Epydoc 3.0.1 on Mon Oct 9 03:28:29 2017 http://epydoc.sourceforge.net