Package rekall :: Package plugins :: Package windows :: Module vadinfo :: Class VadScanner

Class VadScanner

A scanner over all memory regions of a process.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.scan.BaseScanner)
	top_level_class Base class for all scanners. (Inherited from rekall.scan.BaseScanner)

Instance Methods

__init__(self, task=None, process_profile=None, **kwargs)
Scan the process address space through the Vads.

source code

scan(self, offset=0, maxlen=None)
Scan the region from offset for maxlen.

source code

build_constraints(self) (Inherited from rekall.scan.BaseScanner)

source code

check_addr(self, offset, buffer_as=None)
Check an address. (Inherited from rekall.scan.BaseScanner)

source code

skip(self, buffer_as, offset)
Skip uninteresting regions. (Inherited from rekall.scan.BaseScanner)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

Class Variables
	checks = `()` (Inherited from rekall.scan.BaseScanner)
	classes = `{'BaseScanner': <class 'rekall.scan.BaseScanner'>, '...` (Inherited from rekall.scan.BaseScanner)
	classes_by_name = `{None: [<class 'rekall.scan.BaseScanner'>, <...` (Inherited from rekall.scan.BaseScanner)
	overlap = `1024` (Inherited from rekall.scan.BaseScanner)
	plugin_feature = `'BaseScanner'` (Inherited from rekall.scan.BaseScanner)
	progress_message = `'Scanning 0x%(offset)08X with %(name)s'` (Inherited from rekall.scan.BaseScanner)

Properties
Inherited from `object`: `__class__`

Method Details

init(self, task=None, process_profile=None, **kwargs)
(Constructor)

source code

Scan the process address space through the Vads.

Args:
  task: The _EPROCESS object for this task.

  process_profile: The specialized profile for this process. In practice
    this is always different from task.obj_profile (which belongs to the
    kernel). If not provided we default to the kernel profile.

Overrides: object.__init__

scan(self, offset=0, maxlen=None)

source code

Scan the region from offset for maxlen.

Args:
  offset: The starting offset in our current address space to scan.

  maxlen: The maximum length to scan. If not provided we just scan until
    there is no data.

Yields:
  offsets where all the constrainst are satisfied.

Overrides: scan.BaseScanner.scan: (inherited documentation)

ImplementationByClass(self, name)
Class Method

source code

Overrides: scan.BaseScanner.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: scan.BaseScanner.ImplementationByName

Class VadScanner

__init__(self, task=None, process_profile=None, **kwargs) (Constructor)

scan(self, offset=0, maxlen=None)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

init(self, task=None, process_profile=None, **kwargs)
(Constructor)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method