Package rekall :: Package plugins :: Package windows :: Package malware :: Module callbacks :: Class PoolScanPnp9
[frames] | no frames]

Class PoolScanPnp9

source code


PoolScanner for Pnp9 (EventCategoryHardwareProfileChange)

Nested Classes
  __metaclass__
Automatic Plugin Registration through metaclasses. (Inherited from rekall.scan.BaseScanner)
  top_level_class
Base class for all scanners. (Inherited from rekall.scan.BaseScanner)
Instance Methods
 
__init__(self, kernel_address_space=None, **kwargs)
The base scanner.
source code
 
scan(self, offset=0, **kwargs)
Enumerate IoRegisterPlugPlayNotification
source code
 
build_constraints(self) (Inherited from rekall.scan.BaseScanner) source code
 
check_addr(self, offset, buffer_as=None)
Check an address. (Inherited from rekall.scan.BaseScanner)
source code
 
skip(self, buffer_as, offset)
Skip uninteresting regions. (Inherited from rekall.scan.BaseScanner)
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods
 
ImplementationByClass(self, name) source code
 
ImplementationByName(self, name) source code
Class Variables
  checks = [('MultiPoolTagCheck', {'tags': ['Pnp9', 'PnpD', 'Pnp...
  classes = {'BaseScanner': <class 'rekall.scan.BaseScanner'>, '... (Inherited from rekall.scan.BaseScanner)
  classes_by_name = {None: [<class 'rekall.scan.BaseScanner'>, <... (Inherited from rekall.scan.BaseScanner)
  overlap = 1024 (Inherited from rekall.scan.BaseScanner)
  plugin_feature = 'BaseScanner' (Inherited from rekall.scan.BaseScanner)
  progress_message = 'Scanning 0x%(offset)08X with %(name)s' (Inherited from rekall.scan.BaseScanner)
Properties

Inherited from object: __class__

Method Details

__init__(self, kernel_address_space=None, **kwargs)
(Constructor)

source code 
The base scanner.

Args:
   profile: The profile to use for this scan.
   address_space: The address space we use for scanning.
   window_size: The size of the overlap window between each buffer read.

Overrides: object.__init__
(inherited documentation)

scan(self, offset=0, **kwargs)

source code 

Enumerate IoRegisterPlugPlayNotification

Overrides: scan.BaseScanner.scan

ImplementationByClass(self, name)
Class Method

source code 
Overrides: scan.BaseScanner.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code 
Overrides: scan.BaseScanner.ImplementationByName

Class Variable Details

checks

Value:
[('MultiPoolTagCheck', {'tags': ['Pnp9', 'PnpD', 'PnpC']}),
 ('CheckPoolSize',
  {'condition': <function <lambda> at 0x7fafd1bc7848>}),
 ('CheckPoolType', {'free': True, 'non_paged': True, 'paged': True}),
 ('CheckPoolIndex', {'value': 1})]