Trees | Indices | Help |
|
---|
|
Nested Classes | |
__metaclass__ Give each object a unique ID. (Inherited from rekall.obj.BaseObject) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
Class Variables | |
obj_name = <No name>
(Inherited from rekall.obj.BaseObject)
|
|
obj_parent = <No parent>
(Inherited from rekall.obj.BaseObject)
|
|
obj_producers = None hash(x) (Inherited from rekall.obj.BaseObject) |
Properties | |
recovered_contents Gets the full contents of the ring buffer, which may be freed. |
|
size | |
indices Returns (usually 1) representation(s) of self usable as dict keys. (Inherited from rekall.obj.Struct) |
|
obj_end (Inherited from rekall.obj.BaseObject) | |
obj_size (Inherited from rekall.obj.Struct) | |
parents Returns all the parents of this object. (Inherited from rekall.obj.BaseObject) |
|
Inherited from |
Property Details |
recovered_contentsGets the full contents of the ring buffer, which may be freed. This is different from getting the legal contents as with b_to_q [1] because clists are only used by TTYs and they seem to always be all marked as consumed, so b_to_q wouldn't let us see any content. 1: github.com/opensource-apple/xnu/blob/10.9/bsd/kern/tty_subr.c#L358
|
size
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:28:31 2017 | http://epydoc.sourceforge.net |