Class WindowsValidPTEDescriptor

source code

A descriptor for Valid or in Transition PTEs.

Instance Methods

__init__(self, **kwargs)
Define a windows PTE object.

source code

render(self, renderer)
Render this step. (Inherited from rekall.plugins.windows.pagefile.WindowsPTEDescriptor)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables
	default_pte_type = `None` hash(x) (Inherited from rekall.plugins.windows.pagefile.WindowsPTEDescriptor)
	object_name = `'pte'` hash(x) (Inherited from rekall.plugins.windows.pagefile.WindowsPTEDescriptor)

Properties
Inherited from `object`: `__class__`

Method Details

init(self, **kwargs)
(Constructor)

source code

Define a windows PTE object.

Valid PTE types are all the members inside the _MMPTE union. e.g. "Hard", "Transition", "Soft", etc).

Overrides: object.__init__: (inherited documentation)

Class WindowsValidPTEDescriptor

__init__(self, **kwargs) (Constructor)

init(self, **kwargs)
(Constructor)