Trees | Indices | Help |
|
---|
|
The windows Vad tree is basically the same in all versions of windows, but the exact name of the structs vary with version. This is the base class for all Vad traversor.
Nested Classes | |
__metaclass__ Give each object a unique ID. (Inherited from rekall.obj.BaseObject) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
Class Variables | |
tag_map =
|
|
left =
|
|
right =
|
|
obj_name = <No name>
(Inherited from rekall.obj.BaseObject)
|
|
obj_parent = <No parent>
(Inherited from rekall.obj.BaseObject)
|
|
obj_producers = None hash(x) (Inherited from rekall.obj.BaseObject) |
Properties | |
indices Returns (usually 1) representation(s) of self usable as dict keys. (Inherited from rekall.obj.Struct) |
|
obj_end (Inherited from rekall.obj.BaseObject) | |
obj_size (Inherited from rekall.obj.Struct) | |
parents Returns all the parents of this object. (Inherited from rekall.obj.BaseObject) |
|
Inherited from |
Method Details |
Traverse the VAD tree. Generate all the left items, then the right items. We try to be tolerant of cycles by storing all offsets visited. If type is specified we always return that type instead of check the pool tag from the tag_map. |
Class Variable Details |
tag_map
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:28:36 2017 | http://epydoc.sourceforge.net |