Package rekall :: Package plugins :: Package windows :: Package registry :: Module getservicesids :: Class GetServiceSids

[frames] | no frames]

Class GetServiceSids

source code

Get the names of services in the Registry and return Calculated SID

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.plugin.Command)
	top_level_class A command can be run from the rekall command line. (Inherited from rekall.plugin.Command)

Instance Methods

createservicesid(self, service_name)
Calculate the Service SID.

source code

get_service_sids(self)

source code

render(self, renderer)
output to Service SIDs as a dictionary for future use.

source code

__init__(self, hive_offsets=None, hive_regex=None, **kwargs)
Operate on in memory registry hives. (Inherited from rekall.plugins.windows.registry.registry.RegistryPlugin)

source code

__iter__(self)
Make plugins that define collect iterable, as convenience. (Inherited from rekall.plugin.Command)

source code

__repr__(self)
repr(x) (Inherited from rekall.plugin.Command)

source code

__str__(self)
Render into a string using the text renderer. (Inherited from rekall.plugin.Command)

source code

collect(self)
Collect data that will be passed to renderer.table_row. (Inherited from rekall.plugin.TypedProfileCommand)

source code

collect_as_dicts(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

column_types(self)
Returns instances for each column definition. (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_column_type(self, name) (Inherited from rekall.plugin.TypedProfileCommand)

source code

get_plugin(self, name, **kwargs)
Returns an instance of the named plugin. (Inherited from rekall.plugin.Command)

source code

getkeys(self) (Inherited from rekall.plugin.TypedProfileCommand)

source code

list_hives(self) (Inherited from rekall.plugins.windows.registry.registry.RegistryPlugin)

source code

reflect(self, member) (Inherited from rekall.plugin.TypedProfileCommand)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods

GetActiveClasses(cls, session)
Return only the active commands based on config. (Inherited from rekall.plugin.Command)

source code

GetPrototype(cls, session)
Return an instance of this plugin with suitable default arguments. (Inherited from rekall.plugin.Command)

source code

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

args(cls, parser)
Declare the command line args this plugin needs. (Inherited from rekall.plugins.windows.registry.registry.RegistryPlugin)

source code

is_active(cls, session)
Checks we are active. (Inherited from rekall.plugin.ProfileCommand)

source code

Class Variables
	PHYSICAL_AS_REQUIRED = `True` (Inherited from rekall.plugin.PhysicalASMixin)
	PROFILE_REQUIRED = `True` (Inherited from rekall.plugin.ProfileCommand)
	ROW_OPTIONS = `set(['annotation', 'depth', 'hex_width', 'highli...` (Inherited from rekall.plugin.TypedProfileCommand)
	classes = `{'AFF4Acquire': <class 'rekall.plugins.tools.aff4acq...` (Inherited from rekall.plugin.Command)
	classes_by_name = `{None: [<class 'rekall.plugins.tools.ipython...` (Inherited from rekall.plugin.Command)
	error_status = `None` hash(x) (Inherited from rekall.plugin.Command)
	interactive = `False` (Inherited from rekall.plugin.Command)
	mode = `'mode_windows_memory'` hash(x) (Inherited from rekall.plugins.windows.common.AbstractWindowsCommandPlugin)
	plugin_args = `None` hash(x) (Inherited from rekall.plugin.ArgsParserMixin)
	plugin_feature = `'Command'` (Inherited from rekall.plugin.Command)
	producer = `False` (Inherited from rekall.plugin.Command)
	table_header = `None` hash(x) (Inherited from rekall.plugin.TypedProfileCommand)
	table_options = `{}` (Inherited from rekall.plugin.TypedProfileCommand)

Properties
	name (Inherited from rekall.plugin.Command)
Inherited from `object`: `__class__`

Method Details

render(self, renderer)

source code

output to Service SIDs as a dictionary for future use.

Overrides: plugin.Command.render

ImplementationByClass(self, name)
Class Method

source code

Overrides: plugin.Command.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: plugin.Command.ImplementationByName

Class GetServiceSids

render(self, renderer)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method