rekall.plugins.windows.gui.userhandles.WinEventHooks

Class WinEventHooks

Print details on windows event hooks

Nested Classes

__metaclass__
Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugin.Command)

top_level_class
A command can be run from the rekall command line. (Inherited from rekall.plugin.Command)

Instance Methods

render(self, renderer)
Produce results on the renderer given.

source code

__init__(self, win32k_profile=None, **kwargs)
x.__init__(...) initializes x; see help(type(x)) for signature (Inherited from rekall.plugins.windows.gui.win32k_core.Win32kPluginMixin)

source code

__iter__(self)
Make plugins that define collect iterable, as convenience. (Inherited from rekall.plugin.Command)

source code

__repr__(self)
repr(x) (Inherited from rekall.plugin.Command)

source code

__str__(self)
Render into a string using the text renderer. (Inherited from rekall.plugin.Command)

source code

collect(self)
Collect data that will be passed to renderer.table_row. (Inherited from rekall.plugin.TypedProfileCommand)

source code

collect_as_dicts(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

column_types(self)
Returns instances for each column definition. (Inherited from rekall.plugin.TypedProfileCommand)

source code

filter_processes(self)
Filters eprocess list using pids lists. (Inherited from rekall.plugins.windows.common.WinProcessFilter)

source code

get_column(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column_type(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_plugin(self, name, **kwargs)
Returns an instance of the named plugin. (Inherited from rekall.plugin.Command)

source code

getkeys(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

list_eprocess(self)
List processes using chosen methods. (Inherited from rekall.plugins.windows.common.WinProcessFilter)

source code

list_from_eprocess(self) (Inherited from rekall.plugins.windows.common.WinProcessFilter)

source code

reflect(self, member) (Inherited from rekall.plugin.TypedProfileCommand)

source code

virtual_process_from_physical_offset(self, physical_offset)
Tries to return an eprocess in virtual space from a physical offset. (Inherited from rekall.plugins.windows.common.WinProcessFilter)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Variables

name = 'eventhooks'

METHODS = ['PsActiveProcessHead', 'CSRSS', 'PspCidTable', 'Ses... (Inherited from rekall.plugins.windows.common.WinProcessFilter)

PHYSICAL_AS_REQUIRED = True (Inherited from rekall.plugin.PhysicalASMixin)

PROFILE_REQUIRED = True (Inherited from rekall.plugin.ProfileCommand)

ROW_OPTIONS = set(['annotation', 'depth', 'hex_width', 'highli... (Inherited from rekall.plugin.TypedProfileCommand)

classes = {'AFF4Acquire': <class 'rekall.plugins.tools.aff4acq... (Inherited from rekall.plugin.Command)

classes_by_name = {None: [<class 'rekall.plugins.tools.ipython... (Inherited from rekall.plugin.Command)

error_status = None
hash(x) (Inherited from rekall.plugin.Command)

interactive = False (Inherited from rekall.plugin.Command)

mode = 'mode_windows_memory'
hash(x) (Inherited from rekall.plugins.windows.common.AbstractWindowsCommandPlugin)

plugin_args = None
hash(x) (Inherited from rekall.plugin.ArgsParserMixin)

plugin_feature = 'Command' (Inherited from rekall.plugin.Command)

producer = False (Inherited from rekall.plugin.Command)

table_header = None
hash(x) (Inherited from rekall.plugin.TypedProfileCommand)

table_options = {} (Inherited from rekall.plugin.TypedProfileCommand)

Method Details

render(self, renderer)

source code

Produce results on the renderer given.

Each plugin should implement this method to produce output on the
renderer. The framework will initialize the plugin and provide it with
some kind of renderer to write output on. The plugin should not assume
that the renderer is actually TextRenderer, only that the methods
defined in the BaseRenderer exist.

Args:
  renderer: A renderer based at rekall.ui.renderer.BaseRenderer.

Overrides: plugin.Command.render: (inherited documentation)

Class WinEventHooks

render(self, renderer)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method

Properties
	filtering_requested (Inherited from rekall.plugins.windows.common.WinProcessFilter)
Inherited from `object`: `__class__`

Class WinEventHooks

render(self, renderer)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method