Package rekall :: Package plugins :: Package windows :: Module misc :: Class WinImageFingerprint
[frames] | no frames]

Class WinImageFingerprint

source code


Fingerprint the current image.

This parameter tries to get something unique about the image quickly. The
idea is that two different images (even of the same system at different
points in time) will have very different fingerprints. The fingerprint is
used as a key to cache persistent information about the system.

Live systems can not have a stable fingerprint and so return a NoneObject()
here.

We return a list of tuples:
   (physical_offset, expected_data)

The list uniquely identifies the image. If one were to read all physical
offsets and find the expected_data at these locations, then we have a very
high level of confidence that the image is unique and matches the
fingerprint.

Nested Classes
  __metaclass__
Automatic Plugin Registration through metaclasses. (Inherited from rekall.kb.ParameterHook)
  top_level_class
A mechanism for automatically calculating a parameter. (Inherited from rekall.kb.ParameterHook)
Instance Methods
 
calculate(self)
Derive the value of the parameter.
source code
 
__init__(self, session)
x.__init__(...) initializes x; see help(type(x)) for signature (Inherited from rekall.kb.ParameterHook)
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods
 
ImplementationByClass(self, name) source code
 
ImplementationByName(self, name) source code
 
is_active(cls, session)
Checks we are active. (Inherited from rekall.plugin.ModeBasedActiveMixin)
source code
Class Variables
  name = 'image_fingerprint'
hash(x)
  classes = {'AMD64Mode': <class 'rekall.plugins.modes.AMD64Mode... (Inherited from rekall.kb.ParameterHook)
  classes_by_name = {'ObjectTypeMap': [<class 'rekall.plugins.ov... (Inherited from rekall.kb.ParameterHook)
  expiry = None
hash(x) (Inherited from rekall.kb.ParameterHook)
  mode = 'mode_windows_memory'
hash(x) (Inherited from rekall.plugins.windows.common.AbstractWindowsParameterHook)
  plugin_feature = 'ParameterHook' (Inherited from rekall.kb.ParameterHook)
  volatile = True (Inherited from rekall.kb.ParameterHook)
Properties

Inherited from object: __class__

Method Details

calculate(self)

source code 

Derive the value of the parameter.

Overrides: kb.ParameterHook.calculate
(inherited documentation)

ImplementationByClass(self, name)
Class Method

source code 
Overrides: kb.ParameterHook.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code 
Overrides: kb.ParameterHook.ImplementationByName