Profile for Windows live analysis.
|
|
__init__(self,
proc=None,
**kwargs)
x.__init__(...) initializes x; see help(type(x)) for signature |
source code
|
|
|
|
|
|
|
|
|
|
Object(self,
type_name=None,
offset=None,
vm=None,
name=None,
parent=None,
context=None,
**kwargs)
A function which instantiates the object named in type_name (as
a string) from the type in profile passing optional args of
kwargs.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
add_classes(self,
classes_dict=None,
**kwargs)
Add the classes in the dict to our object classes mapping.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
|
|
add_constants(self,
constants=None,
constants_are_addresses=False,
**_)
Add the kwargs as constants for this profile.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
get_constant_object(self,
constant,
target=None,
target_args=None,
vm=None,
**kwargs)
A help function for retrieving pointers from the symbol table.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
|
|
get_nearest_constant_by_address(self,
address,
below=True)
Returns the closest constant below or equal to the address.
(Inherited from rekall.obj.Profile) |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Inherited from object:
__delattr__,
__format__,
__getattribute__,
__hash__,
__new__,
__reduce__,
__reduce_ex__,
__setattr__,
__sizeof__,
__str__,
__subclasshook__
|
