rekall.plugins.overlays.windows.pe

Class ThunkArray

A sential terminated array of thunks.

Nested Classes

__metaclass__
Give each object a unique ID. (Inherited from rekall.obj.BaseObject)

Instance Methods

__init__(self, parent=None, context=None, **kwargs)
Instantiate an array of like items.

source code

GetData(self)
Returns the raw data of this object. (Inherited from rekall.obj.BaseObject)

source code

__dir__(self)
Hide any members with _. (Inherited from rekall.obj.BaseObject)

source code

__eq__(self, other) (Inherited from rekall.obj.Array)

source code

__format__(self, formatspec)
default object formatter (Inherited from rekall.obj.BaseObject)

source code

__getitem__(self, pos) (Inherited from rekall.obj.Array)

source code

__hash__(self)
hash(x) (Inherited from rekall.obj.BaseObject)

source code

__iter__(self)
Break when the sentinel is reached. (Inherited from rekall.plugins.overlays.windows.pe_vtypes.SentinelArray)

source code

__len__(self) (Inherited from rekall.obj.Array)

source code

__nonzero__(self)
This method is called when we test the truth value of an Object. (Inherited from rekall.obj.BaseObject)

source code

__repr__(self)
repr(x) (Inherited from rekall.obj.Array)

source code

__setitem__(self, item, value) (Inherited from rekall.obj.Array)

source code

__str__(self)
str(x) (Inherited from rekall.obj.BaseObject)

source code

__unicode__(self) (Inherited from rekall.obj.Array)

source code

cast(self, type_name=None, vm=None, **kwargs) (Inherited from rekall.obj.BaseObject)

source code

deref(self, vm=None)
An alias for dereference - less to type. (Inherited from rekall.obj.BaseObject)

source code

dereference(self, vm=None) (Inherited from rekall.obj.BaseObject)

source code

is_valid(self) (Inherited from rekall.obj.BaseObject)

source code

m(self, memname) (Inherited from rekall.obj.BaseObject)

source code

proxied(self) (Inherited from rekall.obj.BaseObject)

source code

reference(self)
Produces a pointer to this object. (Inherited from rekall.obj.BaseObject)

source code

v(self, vm=None)
Do the actual reading and decoding of this member (Inherited from rekall.obj.BaseObject)

source code

write(self, value)
Function for writing the object back to disk (Inherited from rekall.obj.BaseObject)

source code

Inherited from object: __delattr__, __getattribute__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

getproperties(cls)
Return all members that are intended to represent some data. (Inherited from rekall.obj.BaseObject)

source code

Class Variables

obj_name = <No name> (Inherited from rekall.obj.BaseObject)

obj_parent = <No parent> (Inherited from rekall.obj.BaseObject)

obj_producers = None
hash(x) (Inherited from rekall.obj.BaseObject)

target_size = 0 (Inherited from rekall.obj.Array)

Properties

indices
Returns (usually 1) representation(s) of self usable as dict keys. (Inherited from rekall.obj.BaseObject)

obj_end (Inherited from rekall.obj.BaseObject)

obj_size
The size of the entire array. (Inherited from rekall.obj.Array)

parents
Returns all the parents of this object. (Inherited from rekall.obj.BaseObject)

Inherited from object: __class__

Method Details

init(self, parent=None, context=None, **kwargs)
(Constructor)

source code

Instantiate an array of like items.

Args:
  count: How many items belong to the array (not strictly enforced -
    i.e. it is possible to read past the end). By default the array is
    unbound.

  max_count: The maximum size of the array. This is a safety mechanism
    if count is calculated. max_count should be set to an upper bound on
    the size of the array.

  target: The name of the element to be instantiated on each point. The
    size of the object returned by this should be the same for all
    members of the array (i.e. all elements should be the same size).

  size: The total size of the Array. If this is nonzero we calculate the
  count so that just the right number of items fit in this specified
  size.

Overrides: object.__init__: (inherited documentation)

Class ThunkArray

__init__(self, parent=None, context=None, **kwargs) (Constructor)

init(self, parent=None, context=None, **kwargs)
(Constructor)