Trees       Indices       Help   
Rekall Memory Forensics
Package rekall :: Package plugins :: Package windows :: Package registry :: Module registry :: Class HiveAddressSpace
[frames] | no frames]

Class HiveAddressSpace

source code

Nested Classes
  __metaclass__
Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace)
  top_level_class
This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace)
Instance Methods
 
__init__(self, hive_addr=None, profile=None, **kwargs)
Translate between hive addresses and virtual memory addresses.		 source code
 
vtop(self, vaddr)
Return the physical address of this virtual address.		 source code
 
save(self)
A generator of registry data in linear form.		 source code
 
stats(self, stable=True) source code
 
ConfigureSession(self, session_obj)
Implement this method if you need to configure the session. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
__eq__(self, other) (Inherited from rekall.addrspace.BaseAddressSpace) source code
 
__repr__(self)
repr(x) (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
__str__(self)
str(x) (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
__unicode__(self) (Inherited from rekall.addrspace.BaseAddressSpace) source code
 
as_assert(self, assertion, error=None)
Duplicate for the assert command (so that optimizations don't disable them) (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
close(self) (Inherited from rekall.addrspace.BaseAddressSpace) source code
 
describe(self, addr)
Return a string describing an address. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
end(self) (Inherited from rekall.addrspace.BaseAddressSpace) source code
 
get_address_ranges(self, start=0, end=4503599627370495)
Generates the runs which fall between start and end. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
get_file_address_space(self, filename)
Implement this to return an address space for filename. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
get_mapped_offset(self, filename, offset)
Implement this if we can map files into this address space. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
get_mappings(self, start=0, end=18446744073709551616)
Generates a sequence of Run() objects. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
is_valid_address(self, addr)
Tell us if the address is valid (Inherited from rekall.addrspace.PagedReader)		 source code
 
merge_base_ranges(self, start=0, end=4503599627370495)
Generates merged address ranges from get_mapping(). (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
read(self, addr, length)
Read 'length' bytes from the virtual address 'vaddr'. (Inherited from rekall.addrspace.PagedReader)		 source code
 
vtop_run(self, addr)
Returns a Run object describing where addr can be read from. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
 
write(self, addr, buf)
Write to the address space, if writable. (Inherited from rekall.addrspace.PagedReader)		 source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods
 
ImplementationByClass(self, name) source code
 
ImplementationByName(self, name) source code
 
metadata(cls, name, default=None)
Obtain metadata about this address space. (Inherited from rekall.addrspace.BaseAddressSpace)		 source code
Class Variables
  CI_TYPE_MASK = 2147483648
  CI_TYPE_SHIFT = 31
  CI_TABLE_MASK = 2145386496
  CI_TABLE_SHIFT = 21
  CI_BLOCK_MASK = 2093056
  CI_BLOCK_SHIFT = 12
  CI_OFF_MASK = 4095
  CI_OFF_SHIFT = 0
  BLOCK_SIZE = 4096 (Inherited from rekall.plugins.windows.registry.registry.HiveBaseAddressSpace)
  PAGE_MASK = -4096 (Inherited from rekall.addrspace.PagedReader)
  PAGE_SIZE = 0x1000 (Inherited from rekall.plugins.windows.registry.registry.HiveBaseAddressSpace)
  classes = {'AFF4AddressSpace': <class 'rekall.plugins.addrspac... (Inherited from rekall.addrspace.BaseAddressSpace)
  classes_by_name = {'': [<class 'rekall.addrspace.BufferAddress... (Inherited from rekall.addrspace.BaseAddressSpace)
  name = '' (Inherited from rekall.addrspace.BaseAddressSpace)
  order = 10 (Inherited from rekall.addrspace.BaseAddressSpace)
  plugin_feature = 'BaseAddressSpace' (Inherited from rekall.addrspace.BaseAddressSpace)
  virtualized = False (Inherited from rekall.addrspace.BaseAddressSpace)
  volatile = False (Inherited from rekall.addrspace.BaseAddressSpace)
Properties
  Name

Inherited from object: __class__

Method Details

__init__(self, hive_addr=None, profile=None, **kwargs)
(Constructor)

source code  
Translate between hive addresses and virtual memory addresses.

This must be constructed over the kernel virtual memory.
Args:
   hive_addr: The virtual address of the _CMHIVE object.
   profile: A profile which holds registry symbols.
Overrides: object.__init__

vtop(self, vaddr)

source code 

Return the physical address of this virtual address.

Overrides: addrspace.BaseAddressSpace.vtop
(inherited documentation)

save(self)

source code  
A generator of registry data in linear form.

This can be used to write a registry file.

Yields:
   blocks of data in order.

ImplementationByClass(self, name)
Class Method

source code 
Overrides: addrspace.BaseAddressSpace.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code 
Overrides: addrspace.BaseAddressSpace.ImplementationByName

Property Details

Name

Get Method:
unreachable.Name(self)

   Trees       Indices       Help   
Rekall Memory Forensics
Generated by Epydoc 3.0.1 on Mon Oct 9 03:29:23 2017 http://epydoc.sourceforge.net