Package rekall :: Package plugins :: Package overlays :: Package darwin :: Module macho

Module macho

This profile is for the Mach-O file format.

References:

https://developer.apple.com/library/mac/documentation/DeveloperTools/Conceptual/MachORuntime/Reference/reference.html http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/EXTERNAL_HEADERS/Mach-O/loader.h https://github.com/llvm-mirror/llvm/blob/release_34/include/llvm/Support/MachO.h https://github.com/opensource-apple/xnu/blob/10.9/EXTERNAL_HEADERS/Mach-O/loader.h

Authors:: Michael Cohen <scudette@gmail.com>, Adam Sindelar <adamsh@google.com

Classes
	MachoProfile A profile for Mach-O files.

Variables
	macho_vtypes = `{'mach_header_64': [32, {'cputype': [None, ['En...`
	__package__ = `'rekall.plugins.overlays.darwin'`

Variables Details

macho_vtypes

Value:

{'mach_header_64': [32,
                    {'cputype': [None,
                                 ['Enumeration',
                                  {'choices': {1: 'VAX',
                                               6: 'MC680x0',
                                               7: 'i386',
                                               8: 'MIPS',
                                               10: 'MC98000',
...