Package rekall :: Package plugins :: Package tools :: Module disassembler :: Class Disassemble

Class Disassemble

Disassemble the given offset.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugin.Command)
	top_level_class A command can be run from the rekall command line. (Inherited from rekall.plugin.Command)

Instance Methods

__init__(self, *args, **kwargs)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

disassemble(self, offset, depth=0)
Disassemble the number of instructions required.

source code

render_canonical(self, renderer)
Renders a canonical description of each instruction.

source code

render(self, renderer, **options)
Disassemble code at a given address.

source code

collect(self)
Collect data that will be passed to renderer.table_row.

source code

__iter__(self)
Make plugins that define collect iterable, as convenience. (Inherited from rekall.plugin.Command)

source code

__repr__(self)
repr(x) (Inherited from rekall.plugin.Command)

source code

__str__(self)
Render into a string using the text renderer. (Inherited from rekall.plugin.Command)

source code

collect_as_dicts(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

column_types(self)
Returns instances for each column definition. (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column_type(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_plugin(self, name, **kwargs)
Returns an instance of the named plugin. (Inherited from rekall.plugin.Command)

source code

getkeys(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

reflect(self, member) (Inherited from rekall.plugin.TypedProfileCommand)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

GetActiveClasses(cls, session)
Return only the active commands based on config. (Inherited from rekall.plugin.Command)

source code

GetPrototype(cls, session)
Return an instance of this plugin with suitable default arguments. (Inherited from rekall.plugin.Command)

source code

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

args(cls, parser) (Inherited from rekall.plugin.TypedProfileCommand)

source code

is_active(cls, session)
Checks we are active. (Inherited from rekall.plugin.ModeBasedActiveMixin)

source code

Class Variables
	table_header = `[{'child': {'style': 'address'}, 'name': 'addre...` hash(x)
	ROW_OPTIONS = `set(['annotation', 'depth', 'hex_width', 'highli...` (Inherited from rekall.plugin.TypedProfileCommand)
	classes = `{'AFF4Acquire': <class 'rekall.plugins.tools.aff4acq...` (Inherited from rekall.plugin.Command)
	classes_by_name = `{None: [<class 'rekall.plugins.tools.ipython...` (Inherited from rekall.plugin.Command)
	error_status = `None` hash(x) (Inherited from rekall.plugin.Command)
	interactive = `False` (Inherited from rekall.plugin.Command)
	mode = `None` hash(x) (Inherited from rekall.plugin.Command)
	plugin_args = `None` hash(x) (Inherited from rekall.plugin.ArgsParserMixin)
	plugin_feature = `'Command'` (Inherited from rekall.plugin.Command)
	producer = `False` (Inherited from rekall.plugin.Command)
	table_options = `{}` (Inherited from rekall.plugin.TypedProfileCommand)

Properties
	name (Inherited from rekall.plugin.Command)
Inherited from `object`: `__class__`

Method Details

init(self, *args, **kwargs)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

disassemble(self, offset, depth=0)

source code

Disassemble the number of instructions required.

Yields:
  A tuple of (Address, Opcode, Instructions).

render_canonical(self, renderer)

source code

Renders a canonical description of each instruction.

Canonical descriptions are machine readable representations of the instruction which can be used to write disassembler signatures.

render(self, renderer, **options)

source code

Disassemble code at a given address.

Disassembles code starting at address for a number of bytes
given by the length parameter (default: 128).

Note: This feature requires capstone, available at
    http://www.capstone-engine.org/

The mode is '32bit' or '64bit'. If not supplied, the disassembler
mode is taken from the profile.

Overrides: plugin.Command.render

collect(self)

source code

Collect data that will be passed to renderer.table_row.

Overrides: plugin.TypedProfileCommand.collect: (inherited documentation)

ImplementationByClass(self, name)
Class Method

source code

Overrides: plugin.Command.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: plugin.Command.ImplementationByName

Class Variable Details

table_header

hash(x)

Value:

[{'child': {'style': 'address'},
  'name': 'address',
  'type': 'TreeNode',
  'width': 20},
 {'name': 'rel', 'style': 'address', 'width': 5},
 {'name': 'opcode', 'width': 20},
 {'name': 'instruction', 'width': 40},
 {'name': 'comment'}]

Class Disassemble

__init__(self, *args, **kwargs) (Constructor)

disassemble(self, offset, depth=0)

render_canonical(self, renderer)

render(self, renderer, **options)

collect(self)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

table_header

init(self, *args, **kwargs)
(Constructor)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method