volatility.framework.symbols.generic package¶
-
class
GenericIntelProcess
(context, type_name, object_info, size, members)[source]¶ Bases:
volatility.framework.objects.StructType
Constructs an Object adhering to the ObjectInterface.
- Parameters
context (
ContextInterface
) – The context associated with the objecttype_name (
str
) – The name of the type structure for the objectobject_info (
ObjectInformation
) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
-
class
VolTemplateProxy
¶ Bases:
volatility.framework.interfaces.objects.VolTemplateProxy
-
classmethod
has_member
(template, member_name)¶ Returns whether the object would contain a member called member_name.
- Return type
-
classmethod
relative_child_offset
(template, child)¶ Returns the relative offset of a child to its parent.
- Return type
-
classmethod
replace_child
(template, old_child, new_child)¶ Replace a child elements within the arguments handed to the template.
- Return type
None
-
classmethod
-
cast
(new_type_name, **additional)¶ Returns a new object at the offset and from the layer that the current object inhabits.
Note
If new type name does not include a symbol table, the symbol table for the current object is used
- Return type
-
get_symbol_table
()¶ Returns the symbol table for this particular object.
Returns none if the symbol table cannot be identified.
- Return type
-
has_member
(member_name)¶ Returns whether the object would contain a member called member_name.
- Return type
-
property
vol
¶ Returns the volatility specific object information.
- Return type
-
write
(value)¶ Writes the new value into the format at the offset the object currently resides at.