A profile for crash dumps.
|
|
|
|
|
Object(self,
type_name=None,
offset=None,
vm=None,
name=None,
parent=None,
context=None,
**kwargs)
A function which instantiates the object named in type_name (as
a string) from the type in profile passing optional args of
kwargs.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
add_classes(self,
classes_dict=None,
**kwargs)
Add the classes in the dict to our object classes mapping.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
add_constants(self,
constants=None,
constants_are_addresses=False,
**_)
Add the kwargs as constants for this profile.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
get_constant_object(self,
constant,
target=None,
target_args=None,
vm=None,
**kwargs)
A help function for retrieving pointers from the symbol table.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
get_nearest_constant_by_address(self,
address,
below=True)
Returns the closest constant below or equal to the address.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Inherited from object :
__delattr__ ,
__format__ ,
__getattribute__ ,
__hash__ ,
__new__ ,
__reduce__ ,
__reduce_ex__ ,
__setattr__ ,
__sizeof__ ,
__str__ ,
__subclasshook__
|