Package rekall :: Package plugins :: Package windows :: Module common

Module common

This plugin contains CORE classes used by lots of other plugins

Classes
	AbstractWindowsCommandPlugin A base class for all windows based plugins.
	AbstractWindowsParameterHook
	WinDTBScanner
	WinFindDTB A plugin to search for the Directory Table Base for windows systems.
	PoolTagCheck This scanner checks for the occurrence of a pool tag.
	MultiPoolTagCheck This scanner checks for the occurrence of a pool tag.
	CheckPoolSize Check pool block size
	CheckPoolType Check the pool type
	CheckPoolIndex Checks the pool index
	PoolScanner A scanner for pool allocations.
	KDBGHook A Hook to calculate the KDBG when needed.
	PsActiveProcessHeadHook The PsActiveProcessHead is actually found in the profile symbols.
	PsLoadedModuleList The PsLoadedModuleList is actually found in the profile symbols.
	WindowsCommandPlugin A windows plugin which requires the kernel address space.
	WinProcessFilter A class for filtering processes.
	WinScanner Windows specific scanner implementation.
	PoolScannerPlugin
	PsListPsActiveProcessHeadHook
	PsListCSRSSHook
	PsListPspCidTableHook
	PsListSessionsHook
	PsListHandlesHook

Variables
	KERNEL_NAMES = `set(['ntkrnlmp.pdb', 'ntkrnlpa.pdb', 'ntkrpamp....`
	__package__ = `'rekall.plugins.windows'`

Variables Details

Value:

set(['ntkrnlmp.pdb', 'ntkrnlpa.pdb', 'ntkrpamp.pdb', 'ntoskrnl.pdb'])