Package rekall :: Package plugins :: Package windows :: Package malware :: Module callbacks :: Class CallbackScan

Class CallbackScan

Print system-wide notification routines by scanning for them.

Note this plugin is quite inefficient - consider using the callbacks plugin instead.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugin.Command)
	top_level_class A command can be run from the rekall command line. (Inherited from rekall.plugin.Command)

Instance Methods

__init__(self, scan_in_kernel_address_space=False, **kwargs)
A mixin for plugins which require a valid kernel address space.

source code

get_kernel_callbacks(self)
Enumerate the Create Process, Create Thread, and Image Load callbacks.

source code

get_bugcheck_callbacks(self)
Enumerate generic Bugcheck callbacks.

source code

get_registry_callbacks_legacy(self)
Enumerate registry change callbacks.

source code

get_bugcheck_reason_callbacks(self)
Enumerate Bugcheck Reason callbacks.

source code

generate_hits(self)

source code

render(self, renderer)
Produce results on the renderer given.

source code

__iter__(self)
Make plugins that define collect iterable, as convenience. (Inherited from rekall.plugin.Command)

source code

__repr__(self)
repr(x) (Inherited from rekall.plugin.Command)

source code

__str__(self)
Render into a string using the text renderer. (Inherited from rekall.plugin.Command)

source code

collect(self)
Collect data that will be passed to renderer.table_row. (Inherited from rekall.plugin.TypedProfileCommand)

source code

collect_as_dicts(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

column_types(self)
Returns instances for each column definition. (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column_type(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_plugin(self, name, **kwargs)
Returns an instance of the named plugin. (Inherited from rekall.plugin.Command)

source code

getkeys(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

reflect(self, member) (Inherited from rekall.plugin.TypedProfileCommand)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

GetActiveClasses(cls, session)
Return only the active commands based on config. (Inherited from rekall.plugin.Command)

source code

GetPrototype(cls, session)
Return an instance of this plugin with suitable default arguments. (Inherited from rekall.plugin.Command)

source code

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

args(cls, metadata) (Inherited from rekall.plugin.PhysicalASMixin)

source code

is_active(cls, session)
Checks we are active. (Inherited from rekall.plugin.ProfileCommand)

source code

Class Variables
	PHYSICAL_AS_REQUIRED = `True` (Inherited from rekall.plugin.PhysicalASMixin)
	PROFILE_REQUIRED = `True` (Inherited from rekall.plugin.ProfileCommand)
	ROW_OPTIONS = `set(['annotation', 'depth', 'hex_width', 'highli...` (Inherited from rekall.plugin.TypedProfileCommand)
	classes = `{'AFF4Acquire': <class 'rekall.plugins.tools.aff4acq...` (Inherited from rekall.plugin.Command)
	classes_by_name = `{None: [<class 'rekall.plugins.tools.ipython...` (Inherited from rekall.plugin.Command)
	error_status = `None` hash(x) (Inherited from rekall.plugin.Command)
	interactive = `False` (Inherited from rekall.plugin.Command)
	mode = `'mode_windows_memory'` hash(x) (Inherited from rekall.plugins.windows.common.AbstractWindowsCommandPlugin)
	plugin_args = `None` hash(x) (Inherited from rekall.plugin.ArgsParserMixin)
	plugin_feature = `'Command'` (Inherited from rekall.plugin.Command)
	producer = `False` (Inherited from rekall.plugin.Command)
	table_header = `None` hash(x) (Inherited from rekall.plugin.TypedProfileCommand)
	table_options = `{}` (Inherited from rekall.plugin.TypedProfileCommand)

Properties
	name (Inherited from rekall.plugin.Command)
Inherited from `object`: `__class__`

Method Details

init(self, scan_in_kernel_address_space=False, **kwargs)
(Constructor)

source code

A mixin for plugins which require a valid kernel address space.

Args:
  dtb: A potential dtb to be used.

Overrides: object.__init__: (inherited documentation)

get_kernel_callbacks(self)

source code

Enumerate the Create Process, Create Thread, and Image Load callbacks.

On some systems, the byte sequences will be inaccurate or the exported function will not be found. In these cases, the PoolScanGenericCallback scanner will pick up the pool associated with the callbacks.

get_bugcheck_callbacks(self)

source code

Enumerate generic Bugcheck callbacks.

Note: These structures don't exist in tagged pools, but you can find them via KDDEBUGGER_DATA64 on all versions of Windows.

get_registry_callbacks_legacy(self)

source code

Enumerate registry change callbacks.

On XP these are registered using CmRegisterCallback.

On Vista and Windows 7, these callbacks are registered using the CmRegisterCallbackEx function.

render(self, renderer)

source code

Produce results on the renderer given.

Each plugin should implement this method to produce output on the
renderer. The framework will initialize the plugin and provide it with
some kind of renderer to write output on. The plugin should not assume
that the renderer is actually TextRenderer, only that the methods
defined in the BaseRenderer exist.

Args:
  renderer: A renderer based at rekall.ui.renderer.BaseRenderer.

Overrides: plugin.Command.render: (inherited documentation)

ImplementationByClass(self, name)
Class Method

source code

Overrides: plugin.Command.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: plugin.Command.ImplementationByName

Class CallbackScan

__init__(self, scan_in_kernel_address_space=False, **kwargs) (Constructor)

get_kernel_callbacks(self)

get_bugcheck_callbacks(self)

get_registry_callbacks_legacy(self)

render(self, renderer)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

init(self, scan_in_kernel_address_space=False, **kwargs)
(Constructor)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method