Package rekall :: Package plugins :: Package overlays :: Module basic :: Class ListMixIn
[frames] | no frames]

Class ListMixIn

source code


A helper for following lists.

Instance Methods
 
dereference_as(self, type, member, vm=None)
Recasts the list entry as a member in a type, and return the type.
source code
 
find_all_lists(self)
Follows all the list entries starting from self.
source code
 
list_of_type(self, type, member) source code
 
list_of_type_fast(self, type, member, include_current=True) source code
 
reflect(self, vm=None)
Reflect this list element by following its Flink and Blink.
source code
 
empty(self) source code
 
__nonzero__(self) source code
 
__iter__(self) source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __init__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties

Inherited from object: __class__

Method Details

dereference_as(self, type, member, vm=None)

source code 
Recasts the list entry as a member in a type, and return the type.

Args:
   type: The name of this Struct type.
   member: The name of the member of this Struct.
   address_space: An optional address space to switch during
      deferencing.

find_all_lists(self)

source code 

Follows all the list entries starting from self.

We basically convert the list to a tree and recursively search it for new nodes. From each node we follow the Flink and then the Blink. When we see a node we already have, we backtrack. This allows us to find nodes which do not satisfy the relation (Due to smear):

x.Flink.Blink = x

Reference: http://en.wikipedia.org/wiki/Depth-first_search

reflect(self, vm=None)

source code 
Reflect this list element by following its Flink and Blink.

This is basically the same as Flink.Blink except that it also checks
Blink.Flink. It also ensures that Flink and Blink are dereferences to
the correct type in case the vtypes do not specify them as pointers.

Returns:
  the result of Flink.Blink.