rekall.plugins.overlays.windows.tcpip

protos

Value:

{0: 'HOPOPT',
 1: 'ICMP',
 2: 'IGMP',
 3: 'GGP',
 4: 'IPv4',
 5: 'ST',
 6: 'TCP',
 7: 'CBT',
...

tcpip_vtypes

Value:

{'_ADDRESS_OBJECT': [104,
                     {'CreateTime': [344, ['WinFileTime', {}]],
                      'LocalIpAddress': [44, ['Ipv4Address']],
                      'LocalPort': [48, ['unsigned be short']],
                      'Next': [0, ['pointer', ['_ADDRESS_OBJECT']]],
                      'Pid': [328, ['unsigned long']],
                      'Protocol': [50, ['unsigned short']]}],
 '_TCPT_OBJECT': [32, {'LocalIpAddress': [16, ['Ipv4Address']], 'Local
...

tcpip_vtypes_2003_x64

Value:

{'_ADDRESS_OBJECT': [592,
                     {'CreateTime': [584, ['WinFileTime', {}]],
                      'LocalIpAddress': [88, ['Ipv4Address']],
                      'LocalPort': [92, ['unsigned be short']],
                      'Next': [0, ['pointer', ['_ADDRESS_OBJECT']]],
                      'Pid': [568, ['unsigned long']],
                      'Protocol': [94, ['unsigned short']]}],
 '_TCPT_OBJECT': [40, {'LocalIpAddress': [24, ['Ipv4Address']], 'Local
...

tcpip_vtypes_2003_sp1_sp2

Value:

{'_ADDRESS_OBJECT': [104,
                     {'CreateTime': [344, ['WinFileTime', {}]],
                      'LocalIpAddress': [48, ['Ipv4Address']],
                      'LocalPort': [52, ['unsigned be short']],
                      'Next': [0, ['pointer', ['_ADDRESS_OBJECT']]],
                      'Pid': [332, ['unsigned long']],
                      'Protocol': [54, ['unsigned short']]}]}

TCP_STATE_ENUM

Value:

{0: 'CLOSED',
 1: 'LISTENING',
 2: 'SYN_SENT',
 3: 'SYN_RCVD',
 4: 'ESTABLISHED',
 5: 'FIN_WAIT1',
 6: 'FIN_WAIT2',
 7: 'CLOSE_WAIT',
...

tcpip_vtypes_vista

Value:

{'FIRST_LEVEL_DIR': [36,
                     {'Mask': [16, ['unsigned int']],
                      'SecondLevel': [32,
                                      ['Pointer',
                                       {'target': 'Array',
                                        'target_args': {'count': <func
tion <lambda> at 0x7fafd235baa0>,
                                                        'target': '_LI
...

tcpip_vtypes_7

Value:

{'_LIST_ENTRY': [8,
                 {'Blink': [4,
                            ['Pointer32', {'target': 'LIST_ENTRY32'}]]
,
                  'Flink': [0,
                            ['Pointer32', {'target': 'LIST_ENTRY32'}]]
}],
 '_TCP_ENDPOINT': [528, {'AddrInfo': [16, ['pointer', ['_ADDRINFO']]],
...

tcpip_vtypes_vista_64

Value:

{'FIRST_LEVEL_DIR': [36,
                     {'Mask': [16, ['unsigned int']],
                      'SecondLevel': [32,
                                      ['Pointer',
                                       {'target': 'Array',
                                        'target_args': {'count': <func
tion <lambda> at 0x7fafd235bb90>,
                                                        'target': '_LI
...

tcpip_vtypes_win7_64

Value:

{'_TCP_ENDPOINT': [800,
                   {'LocalPort': [108, ['unsigned be short']],
                    'Owner': [568, ['pointer', ['_EPROCESS']]],
                    'RemotePort': [110, ['unsigned be short']],
                    'State': [104,
                              ['Enumeration',
                               {'choices': {0: 'CLOSED',
                                            1: 'LISTENING',
...

overlays

Value:

{'_ADDRESS_OBJECT': [None,
                     {'Protocol': [None,
                                   ['Enumeration',
                                    {'choices': {0: 'HOPOPT',
                                                 1: 'ICMP',
                                                 2: 'IGMP',
                                                 3: 'GGP',
                                                 4: 'IPv4',
...

win7_x86_dynamic_overlays

Value:

{'_TCP_LISTENER': {'CreateTime': [['Disassembler',
                                   {'length': 300,
                                    'rules': ['LEA EAX, [EBX+$out]',
                                              'PUSH EAX',
                                              'CALL DWORD *KeQuerySyst
emTime'],
                                    'start': 'tcpip.sys!_TcpCreateList
ener@8',
...

tcpip_vtypes_win10_32

Value:

{'_ADDRINFO': [None,
               {'Local': [0, ['pointer', ['_LOCAL_ADDRESS']]],
                'Remote': [12, ['pointer', ['_IN_ADDR']]]}],
 '_TCP_ENDPOINT': [None,
                   {'AddrInfo': [12, ['pointer', ['_ADDRINFO']]],
                    'InetAF': [8, ['pointer', ['_INETAF']]],
                    'LocalPort': [60, ['unsigned be short']],
                    'Owner': [432, ['pointer', ['_EPROCESS']]],
...

tcpip_vtypes_win10_64

Value:

{'_ADDRINFO': [None,
               {'Local': [0, ['pointer', ['_LOCAL_ADDRESS']]],
                'Remote': [16, ['pointer', ['_IN_ADDR']]]}],
 '_INETAF': [None, {'AddressFamily': [24, ['unsigned short']]}],
 '_IN_ADDR': [None,
              {'addr4': [0, ['Ipv4Address']],
               'addr6': [0, ['Ipv6Address']]}],
 '_LOCAL_ADDRESS': [None, {'pData': [16, ['pointer', ['pointer', ['_IN
...

Classes
	TcpipPluginMixin A mixin for plugins that want to use tcpip.sys profiles.
	Tcpip A profile for the TCPIP driver.
	TcpipHook

Variables
	AF_INET = `2`
	AF_INET6 = `23`
	inaddr_any = `'0.0.0.0'`
	inaddr6_any = `'::'`
	protos = `{0: 'HOPOPT', 1: 'ICMP', 2: 'IGMP', 3: 'GGP', 4: 'IPv...`
	tcpip_vtypes = `{'_ADDRESS_OBJECT': [104, {'CreateTime': [344, ...`
	tcpip_vtypes_2003_x64 = `{'_ADDRESS_OBJECT': [592, {'CreateTime...`
	tcpip_vtypes_2003_sp1_sp2 = `{'_ADDRESS_OBJECT': [104, {'Create...`
	TCP_STATE_ENUM = `{0: 'CLOSED', 1: 'LISTENING', 2: 'SYN_SENT', ...`
	tcpip_vtypes_vista = `{'FIRST_LEVEL_DIR': [36, {'Mask': [16, ['...`
	tcpip_vtypes_7 = `{'_LIST_ENTRY': [8, {'Blink': [4, ['Pointer32...`
	tcpip_vtypes_vista_64 = `{'FIRST_LEVEL_DIR': [36, {'Mask': [16,...`
	tcpip_vtypes_win7_64 = `{'_TCP_ENDPOINT': [800, {'LocalPort': [...`
	overlays = `{'_ADDRESS_OBJECT': [None, {'Protocol': [None, ['En...`
	win7_x86_dynamic_overlays = `{'_TCP_LISTENER': {'CreateTime': [...`
	tcpip_vtypes_win10_32 = `{'_ADDRINFO': [None, {'Local': [0, ['p...`
	tcpip_vtypes_win10_64 = `{'_ADDRINFO': [None, {'Local': [0, ['p...`
	__package__ = `'rekall.plugins.overlays.windows'`

Module tcpip_vtypes

protos

tcpip_vtypes

tcpip_vtypes_2003_x64

tcpip_vtypes_2003_sp1_sp2

TCP_STATE_ENUM

tcpip_vtypes_vista

tcpip_vtypes_7

tcpip_vtypes_vista_64

tcpip_vtypes_win7_64

overlays

win7_x86_dynamic_overlays

tcpip_vtypes_win10_32

tcpip_vtypes_win10_64