rekall.plugins.overlays.linux.linux.hlist

Class hlist_node

Nested Classes

__metaclass__
Give each object a unique ID. (Inherited from rekall.obj.BaseObject)

Instance Methods

list_of_type(self, type, member)

source code

find_all_lists(self, seen)
Follows all the list entries starting from self.

source code

__empty__(self)

source code

GetData(self)
Returns the raw data of this object. (Inherited from rekall.obj.BaseObject)

source code

SetMember(self, attr, value)
Write a value to a member. (Inherited from rekall.obj.Struct)

source code

__comparator__(self, other, method) (Inherited from rekall.obj.BaseAddressComparisonMixIn)

source code

__dir__(self)
Hide any members with _. (Inherited from rekall.obj.BaseObject)

source code

__eq__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn)

source code

__format__(self, formatspec)
default object formatter (Inherited from rekall.obj.BaseObject)

source code

__ge__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn)

source code

__getattr__(self, attr) (Inherited from rekall.obj.Struct)

source code

__gt__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn)

source code

__hash__(self)
hash(x) (Inherited from rekall.obj.Struct)

source code

__init__(self, members=None, struct_size=0, callable_members=None, **kwargs)
This must be instantiated with a dict of members. (Inherited from rekall.obj.Struct)

source code

__int__(self)
Return our offset as an integer. (Inherited from rekall.obj.Struct)

source code

__iter__(self) (Inherited from rekall.plugins.overlays.basic.ListMixIn)

source code

__le__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn)

source code

__long__(self) (Inherited from rekall.obj.Struct)

source code

__lt__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn)

source code

__ne__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn)

source code

__nonzero__(self) (Inherited from rekall.plugins.overlays.basic.ListMixIn)

source code

__repr__(self)
repr(x) (Inherited from rekall.obj.Struct)

source code

__str__(self)
str(x) (Inherited from rekall.obj.BaseObject)

source code

__unicode__(self) (Inherited from rekall.obj.Struct)

source code

cast(self, type_name=None, vm=None, **kwargs) (Inherited from rekall.obj.BaseObject)

source code

deref(self, vm=None)
An alias for dereference - less to type. (Inherited from rekall.obj.BaseObject)

source code

dereference(self, vm=None) (Inherited from rekall.obj.BaseObject)

source code

dereference_as(self, type, member, vm=None)
Recasts the list entry as a member in a type, and return the type. (Inherited from rekall.plugins.overlays.basic.ListMixIn)

source code

empty(self) (Inherited from rekall.plugins.overlays.basic.ListMixIn)

source code

is_valid(self) (Inherited from rekall.obj.BaseObject)

source code

list_of_type_fast(self, type, member, include_current=True) (Inherited from rekall.plugins.overlays.basic.ListMixIn)

source code

m(self, attr, allow_callable_attributes=False)
Fetch the member named by attr. (Inherited from rekall.obj.Struct)

source code

multi_m(self, *args, **opts)
Retrieve a set of fields in order. (Inherited from rekall.obj.Struct)

source code

preamble_size(self)
The number of bytes before the object which are part of the object. (Inherited from rekall.obj.Struct)

source code

proxied(self) (Inherited from rekall.obj.BaseObject)

source code

reference(self)
Produces a pointer to this object. (Inherited from rekall.obj.BaseObject)

source code

reflect(self, vm=None)
Reflect this list element by following its Flink and Blink. (Inherited from rekall.plugins.overlays.basic.ListMixIn)

source code

v(self, vm=None)
When a struct is evaluated we just return our offset. (Inherited from rekall.obj.Struct)

source code

walk_list(self, list_member, include_current=True, deref_as=None)
Walk a single linked list in this struct. (Inherited from rekall.obj.Struct)

source code

write(self, value)
Function for writing the object back to disk (Inherited from rekall.obj.BaseObject)

source code

Inherited from object: __delattr__, __getattribute__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

getproperties(cls)
Return all members that are intended to represent some data. (Inherited from rekall.obj.BaseObject)

source code

Class Variables

obj_name = <No name> (Inherited from rekall.obj.BaseObject)

obj_parent = <No parent> (Inherited from rekall.obj.BaseObject)

obj_producers = None
hash(x) (Inherited from rekall.obj.BaseObject)

Properties

indices
Returns (usually 1) representation(s) of self usable as dict keys. (Inherited from rekall.obj.Struct)

obj_end (Inherited from rekall.obj.BaseObject)

obj_size (Inherited from rekall.obj.Struct)

parents
Returns all the parents of this object. (Inherited from rekall.obj.BaseObject)

Inherited from object: __class__

Method Details

find_all_lists(self, seen)

source code

Follows all the list entries starting from self.

We basically convert the list to a tree and recursively search it for new nodes. From each node we follow the Flink and then the Blink. When we see a node we already have, we backtrack. This allows us to find nodes which do not satisfy the relation (Due to smear):

x.Flink.Blink = x

Reference: http://en.wikipedia.org/wiki/Depth-first_search

Overrides: basic.ListMixIn.find_all_lists: (inherited documentation)