Package rekall :: Package plugins :: Package windows :: Module pagefile :: Class WindowsPTEDescriptor

Class WindowsPTEDescriptor

Print the PTE in exploded view.

Instance Methods

__init__(self, pte_type=None, pte_value=None, pte_addr=None, object_name=None, session=None)
Define a windows PTE object.

source code

render(self, renderer)
Render this step.

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables
	default_pte_type = `None` hash(x)
	object_name = `'pte'` hash(x)

Properties
Inherited from `object`: `__class__`

Method Details

init(self, pte_type=None, pte_value=None, pte_addr=None, object_name=None, session=None)
(Constructor)

source code

Define a windows PTE object.

Valid PTE types are all the members inside the _MMPTE union. e.g. "Hard", "Transition", "Soft", etc).

Overrides: object.__init__

render(self, renderer)

source code

Render this step.

Overrides: addrspaces.intel.AddressTranslationDescriptor.render: (inherited documentation)

Class WindowsPTEDescriptor

__init__(self, pte_type=None, pte_value=None, pte_addr=None, object_name=None, session=None) (Constructor)

render(self, renderer)

init(self, pte_type=None, pte_value=None, pte_addr=None, object_name=None, session=None)
(Constructor)