Trees | Indices | Help |
|
---|
|
An address space which applies to PE files. This basically remaps sections in the PE file to the virtual address space. See http://code.google.com/p/corkami/downloads/detail?name=pe-20110117.pdf The PE file is divided into sections, each section is mapped into memory at a different place: File on Disk Memory Image 0-> ------------ image base-> ------------ Header Header ------------ ------------ Section 1 ------------ ------------ Section 2 Section 1 ------------ ------------ ------------ Section 2 ------------ This address space expands the file from disk into the memory image view as shown. Since all internal pe RVA references are within the virtual space, this helps resolution.
Nested Classes | |
__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
|||
|
|||
|
Class Variables | |
PAGE_MASK = -4096
(Inherited from rekall.addrspace.PagedReader)
|
|
PAGE_SIZE = 4096
(Inherited from rekall.addrspace.PagedReader)
|
|
classes =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
classes_by_name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
order = 10
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
plugin_feature =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
runs = None hash(x) (Inherited from rekall.addrspace.RunBasedAddressSpace) |
|
virtualized = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
volatile = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
Properties | |
Inherited from |
Method Details |
We layer on top of the file address space.
|
str(x)
|
|
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:28:36 2017 | http://epydoc.sourceforge.net |