Package rekall :: Package plugins :: Package windows :: Module heap_analysis

Module heap_analysis

The module implements user mode heap analysis.

Recent versions of windows use the Low Fragmentation Heap (LFH).

http://illmatics.com/Windows%208%20Heap%20Internals.pdf http://illmatics.com/Understanding_the_LFH.pdf http://www.leviathansecurity.com/blog/understanding-the-windows-allocator-a-redux/

Classes
	InspectHeap Inspect the process heap.
	ShowAllocation Show the allocation containing the address.
	FindReferenceAlloc Show allocations that refer to an address.

Variables
	__package__ = `'rekall.plugins.windows'`