Package rekall :: Package plugins :: Package renderers :: Module visual_aides :: Class RunBasedMap
[frames] | no frames]

Class RunBasedMap

source code


MemoryMap representing discrete ranges in memory.

Colors, names and sigils representing the ranges will be read from the
legend.

Arguments:
==========
runs: dict of "start" (int), "end" (int) and "value" (str).
      The value will be used to look up colors and sigils in the legend, so
      it has to match an entry in the legend.
legend: Instance of MapLegend - see doc there.
limit: The highest address in the map. Optional - if not supplied,
       the map will show up to the end of the highest range.
offset: The lowest address in the map. Optional - if not supplied, map
        will start at zero.
caption: Explanation of what the map is showing. Default is 'Offset'
         and is typically overriden to something like 'Offset (v)'.
resolution: How many bytes one cell in the map represents.
cell_width: How long of a string is permitted in the cells themselves.
            This value is important because the cells show sigils
            (see MapLegend) in order of representation.
blend: Should the map attempt to blend the color of overlapping ranges?
       If False the map basically becomes a painter's algorithm.
column_count: How many columns wide should the map be? Lowering this
              value will result in more rows.
cell_count: Alternative to providing resolution, caller may request a map
            of constant size, with variable resolution.

Instance Methods
 
__init__(self, runs, legend, offset=None, limit=None, caption='Offset', resolution=1048576, cell_width=6, blend=True, cell_count=None, column_count=8, *args, **kwargs)
x.__init__(...) initializes x; see help(type(x)) for signature
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables
  caption = 'Offset' (Inherited from rekall.plugins.renderers.visual_aides.MemoryMap)
  column_headers = None
hash(x) (Inherited from rekall.plugins.renderers.visual_aides.MemoryMap)
  greyscale = False (Inherited from rekall.plugins.renderers.visual_aides.MemoryMap)
  legend = None
hash(x) (Inherited from rekall.plugins.renderers.visual_aides.MemoryMap)
  row_headers = None
hash(x) (Inherited from rekall.plugins.renderers.visual_aides.MemoryMap)
  rows = None
hash(x) (Inherited from rekall.plugins.renderers.visual_aides.MemoryMap)
Properties
  cells (Inherited from rekall.plugins.renderers.visual_aides.MemoryMap)

Inherited from object: __class__

Method Details

__init__(self, runs, legend, offset=None, limit=None, caption='Offset', resolution=1048576, cell_width=6, blend=True, cell_count=None, column_count=8, *args, **kwargs)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__
(inherited documentation)