contrib.plugins.psdispscan.PSDispScan Class Reference

Scan Physical memory for _EPROCESS objects based on their Dispatch Headers. More...

Inheritance diagram for contrib.plugins.psdispscan.PSDispScan:

Public Member Functions
def	calculate (self)
def	render_dot (self, outfd, data)
def	render_text (self, outfd, data)

Static Public Attributes
tuple	meta_info

Detailed Description

Scan Physical memory for _EPROCESS objects based on their Dispatch Headers.

Member Data Documentation

tuple contrib.plugins.psdispscan.PSDispScan.meta_info

static

Initial value:

= dict(
        author = 'Brendan Dolan-Gavitt',
        copyright = 'Copyright (c) 2007,2008 Brendan Dolan-Gavitt',
        contact = 'bdolangavitt@wesleyan.edu',
        license = 'GNU General Public License 2.0 or later',
        url = 'http://moyix.blogspot.com/',
        os = 'WIN_32_XP_SP2',
        version = '1.0',
        )

---

The documentation for this class was generated from the following file:

• contrib/plugins/psdispscan.py