This AS supports the HPAK format. More...
Public Member Functions | |
def | __init__ (self, base, config, kwargs) |
def | read (self, addr, length) |
def | zread (self, addr, length) |
def | is_valid_address (self, addr) |
def | get_header (self) |
def | convert_to_raw (self, outfd) |
The standard imageinfo plugin won't work on hpak images so we provide this method. More... | |
Public Member Functions inherited from volatility.plugins.addrspaces.standard.FileAddressSpace | |
def | __init__ (self, base, config, layered=False, kwargs) |
def | fread (self, length) |
def | read (self, addr, length) |
def | zread (self, addr, length) |
def | read_long (self, addr) |
def | get_available_addresses (self) |
def | is_valid_address (self, addr) |
def | close (self) |
def | write (self, addr, data) |
def | __eq__ (self, other) |
Public Member Functions inherited from volatility.addrspace.BaseAddressSpace | |
def | __init__ (self, base, config, _args, _kwargs) |
base is the AS we will be stacking on top of, opts are options which we may use. | |
def | get_config (self) |
Returns the config object used by the vm for use in other vms. | |
def | is_valid_profile (self, profile) |
Determines whether a selected profile is compatible with this address space. | |
def | as_assert |
Duplicate for the assert command (so that optimizations don't disable them) More... | |
def | __eq__ (self, other) |
def | __ne__ (self, other) |
def | read (self, addr, length) |
Read some data from a certain offset. | |
def | zread (self, addr, length) |
Read data from a certain offset padded with where data is not available. | |
def | get_available_addresses (self) |
Return a generator of address ranges as (offset, size) covered by this AS sorted by offset. More... | |
def | is_valid_address (self, _addr) |
Tell us if the address is valid. | |
def | write (self, _addr, _buf) |
def | __getstate__ (self) |
Serialise this address space efficiently. | |
def | __setstate__ (self, state) |
def | address_mask (cls, addr) |
Masks an address value for this address space. | |
def | address_compare (cls, a, b) |
Compares two addresses, a and b, and return -1 if a is less than b, 0 if they're equal and 1 if a is greater than b. | |
def | address_equality (cls, a, b) |
Compare two addresses and returns True if they're the same, or False if they're not. | |
def | physical_space (self) |
Return the underlying physical layer, if there is one. More... | |
Public Attributes | |
header | |
We must have an AS below us. | |
physmem | |
Check the magic. More... | |
Public Attributes inherited from volatility.plugins.addrspaces.standard.FileAddressSpace | |
name | |
fname | |
mode | |
fhandle | |
fsize | |
base | |
Public Attributes inherited from volatility.addrspace.BaseAddressSpace | |
base | |
name | |
profile | |
Static Public Attributes | |
int | order = 30 |
Static Public Attributes inherited from volatility.plugins.addrspaces.standard.FileAddressSpace | |
int | order = 100 |
We should be the AS of last resort. | |
Additional Inherited Members | |
Static Public Member Functions inherited from volatility.plugins.addrspaces.standard.FileAddressSpace | |
def | register_options (config) |
Static Public Member Functions inherited from volatility.addrspace.BaseAddressSpace | |
def | register_options (config) |
This AS supports the HPAK format.
def volatility.plugins.addrspaces.hpak.HPAKAddressSpace.convert_to_raw | ( | self, | |
outfd | |||
) |
The standard imageinfo plugin won't work on hpak images so we provide this method.
It wraps the zlib compression if necessary
volatility.plugins.addrspaces.hpak.HPAKAddressSpace.physmem |
Check the magic.
cycle though looking for the PHYSDUMP header