Package rekall :: Module scan :: Class MultiStringFinderCheck

Class MultiStringFinderCheck

A scanner checker for multiple strings.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.scan.ScannerCheck)
	top_level_class A scanner check is a special class which is invoked on an AS to check for a specific condition. (Inherited from rekall.scan.ScannerCheck)

Instance Methods

__init__(self, needles=None, **kwargs)
Init.

source code

check(self, buffer_as, offset)
Is the needle found at 'offset'?

source code

skip(self, buffer_as, offset)
Determine how many bytes we can skip.

source code

object_offset(self, offset) (Inherited from rekall.scan.ScannerCheck)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

Class Variables
	classes = `{'CheckPoolIndex': <class 'rekall.plugins.windows.co...` (Inherited from rekall.scan.ScannerCheck)
	classes_by_name = `{None: [<class 'rekall.scan.MultiStringFinde...` (Inherited from rekall.scan.ScannerCheck)
	plugin_feature = `'ScannerCheck'` (Inherited from rekall.scan.ScannerCheck)

Properties
Inherited from `object`: `__class__`

Method Details

init(self, needles=None, **kwargs)
(Constructor)

source code

Init.

Args:
  needles: A list of strings we search for.
  **kwargs: passthrough.
Raises:
  RuntimeError: No needles provided.

Overrides: object.__init__

check(self, buffer_as, offset)

source code

Is the needle found at 'offset'?

Arguments:
  buffer_as: An address space object with a chunk of data that can be
    checked for the needle.
offset: The offset in the address space to check.

Overrides: ScannerCheck.check: (inherited documentation)

skip(self, buffer_as, offset)

source code

Determine how many bytes we can skip.

If you want to speed up the scanning define this method - it
will be used to skip the data which is obviously not going to
match. You will need to return the number of bytes from offset
to skip to. We take the maximum number of bytes to guarantee
that all checks have a chance of passing.

Args:
  buffer_as: A BufferAddressSpace instance wrapping self.address_space,
  containing a copy of the data at the specified offset.

  offset: The offset in the address space to check.

Returns:
  Number of bytes to be skipped.

Overrides: ScannerCheck.skip: (inherited documentation)

ImplementationByClass(self, name)
Class Method

source code

Overrides: ScannerCheck.ImplementationByClass

ImplementationByName(self, name)
Class Method

source code

Overrides: ScannerCheck.ImplementationByName

Class MultiStringFinderCheck

__init__(self, needles=None, **kwargs) (Constructor)

check(self, buffer_as, offset)

skip(self, buffer_as, offset)

ImplementationByClass(self, name) Class Method

ImplementationByName(self, name) Class Method

init(self, needles=None, **kwargs)
(Constructor)

ImplementationByClass(self, name)
Class Method

ImplementationByName(self, name)
Class Method