Trees | Indices | Help |
|
---|
|
Translate between hive addresses and a flat file address space.
This is suitable for reading regular registry files. It should be stacked over the FileAddressSpace.
Nested Classes | |
__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.addrspace.BaseAddressSpace) |
|
top_level_class This is the base class of all Address Spaces. (Inherited from rekall.addrspace.BaseAddressSpace) |
Instance Methods | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from |
Class Methods | |||
|
|||
|
|||
|
Class Variables | |
BLOCK_SIZE = 4096
(Inherited from rekall.plugins.windows.registry.registry.HiveBaseAddressSpace)
|
|
PAGE_MASK = -4096
(Inherited from rekall.addrspace.PagedReader)
|
|
PAGE_SIZE = 0x1000
(Inherited from rekall.plugins.windows.registry.registry.HiveBaseAddressSpace)
|
|
classes =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
classes_by_name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
name =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
order = 10
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
plugin_feature =
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
virtualized = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
|
volatile = False
(Inherited from rekall.addrspace.BaseAddressSpace)
|
Properties | |
Name | |
Inherited from |
Method Details |
Base is the AS we will be stacking on top of, opts are options which we may use. Args: base: A base address space to stack on top of (i.e. delegate to it for satisfying read requests). session: An optional session object. profile: An optional profile to use for parsing the address space (e.g. needed for hibernation, crash etc.)
|
Return the physical address of this virtual address.
|
|
|
Property Details |
Name
|
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:29:23 2017 | http://epydoc.sourceforge.net |