Package rekall :: Package plugins :: Package windows :: Module modscan

Module modscan

This module implements the fast module scanning

Author: AAron Walters and Brendan Dolan-Gavitt

License: GNU General Public License 2.0 or later

Contact: awalters@volatilesystems.com,bdolangavitt@wesleyan.edu

Organization: Volatile Systems

Classes
	PoolScanModuleFast
	ModScan Scan Physical memory for _LDR_DATA_TABLE_ENTRY objects.
	PoolScanThreadFast Carve out threat objects using the pool tag
	ThrdScan Scan physical memory for _ETHREAD objects

Variables
	__package__ = `'rekall.plugins.windows'`