The Volatility Framework
volatility.plugins.gui.messagehooks.MessageHooks Class Reference

List desktop and thread window message hooks. More...

Inheritance diagram for volatility.plugins.gui.messagehooks.MessageHooks:
volatility.plugins.gui.atoms.Atoms volatility.plugins.gui.sessions.SessionsMixin volatility.plugins.common.AbstractWindowsCommand volatility.commands.Command volatility.plugins.gui.editbox.EditBox volatility.plugins.gui.windows.Windows volatility.plugins.gui.windows.WinTree

Public Member Functions

def calculate (self)
 
def translate_atom (self, winsta, atom_tables, atom_id)
 Translate an atom into an atom name. More...
 
def translate_hmod (self, winsta, atom_tables, index)
 Translate an ihmod (index into a handle table) into an atom. More...
 
def render_text (self, outfd, data)
 Render output in table form.
 
def render_block (self, outfd, data)
 Render output as a block.
 
- Public Member Functions inherited from volatility.plugins.gui.atoms.Atoms
def calculate (self)
 
def unified_output (self, data)
 
def generator (self, data)
 
def render_text (self, outfd, data)
 
- Public Member Functions inherited from volatility.commands.Command
def __init__ (self, config, _args, _kwargs)
 Constructor uses args as an initializer. More...
 
def help (cls)
 This function returns a string that will be displayed when a user lists available plugins.
 
def calculate (self)
 This function is responsible for performing all calculations. More...
 
def execute (self)
 Executes the plugin command. More...
 
def format_value (self, value, fmt)
 Formats an individual field using the table formatting codes.
 
def table_header
 Table header renders the title row of a table. More...
 
def table_row (self, outfd, args)
 Outputs a single row of a table.
 
def text_cell_renderers (self, columns)
 Returns default renderers for the columns listed.
 
def unified_output (self, data)
 
def render_text (self, outfd, data)
 
def render_greptext (self, outfd, data)
 
def render_json (self, outfd, data)
 
def render_sqlite (self, outfd, data)
 
def render_dot (self, outfd, data)
 
def render_html (self, outfd, data)
 
def render_xlsx (self, outfd, data)
 
- Public Member Functions inherited from volatility.plugins.gui.sessions.SessionsMixin
def session_spaces (self, kernel_space)
 Generators unique _MM_SESSION_SPACE objects referenced by active processes. More...
 
def find_session_space (self, kernel_space, session_id)
 Get a session address space by its ID. More...
 

Additional Inherited Members

- Static Public Member Functions inherited from volatility.plugins.common.AbstractWindowsCommand
def is_valid_profile (profile)
 
- Static Public Member Functions inherited from volatility.commands.Command
def register_options (config)
 Registers options into a config object provided.
 
def is_valid_profile (profile)
 
- Static Public Attributes inherited from volatility.plugins.gui.atoms.Atoms
string text_sort_column = "Atom"
 
- Static Public Attributes inherited from volatility.commands.Command
string op = ""
 
string opts = ""
 
string args = ""
 
string cmdname = ""
 
dictionary meta_info = {}
 
 elide_data = True
 
string tablesep = " "
 
 text_sort_column = None
 
dictionary text_stock_renderers
 

Detailed Description

List desktop and thread window message hooks.

Member Function Documentation

def volatility.plugins.gui.messagehooks.MessageHooks.translate_atom (   self,
  winsta,
  atom_tables,
  atom_id 
)

Translate an atom into an atom name.

Parameters
winstaa tagWINDOWSTATION in the proper session space
atom_tablesa dictionary with _RTL_ATOM_TABLE instances as the keys and owning window stations as the values.
indexthe index into the atom handle table.
def volatility.plugins.gui.messagehooks.MessageHooks.translate_hmod (   self,
  winsta,
  atom_tables,
  index 
)

Translate an ihmod (index into a handle table) into an atom.

This requires locating the win32k!_aatomSysLoaded symbol. If the symbol cannot be found, we'll just report back the ihmod value.

Parameters
winstaa tagWINDOWSTATION in the proper session space
atom_tablesa dictionary with _RTL_ATOM_TABLE instances as the keys and owning window stations as the values.
indexthe index into the atom handle table.

The documentation for this class was generated from the following file: