volatility.framework.symbols.mac.extensions package¶

class fileglob(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_fg_type()[source]¶

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class ifnet(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

sockaddr_dl()[source]¶

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class inpcb(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_ipv4_info()[source]¶

get_ipv6_info()[source]¶

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

get_tcp_state()[source]¶

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class proc(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.symbols.generic.GenericIntelProcess

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

add_process_layer(config_prefix=None, preferred_name=None)[source]¶

Constructs a new layer based on the process’s DTB.

Returns the name of the Layer or None.

Return type: Optional[str]

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_map_iter()[source]¶

Return type: Iterable[ObjectInterface]

get_process_memory_sections(context, config_prefix, rw_no_file=False)[source]¶

Returns a list of sections based on the memory manager’s view of this task’s virtual memory.

Return type: Generator[Tuple[int, int], None, None]

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

get_task()[source]¶

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class queue_entry(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

walk_list(list_head, member_name, type_name, max_size=4096)[source]¶

Return type: Iterable[ObjectInterface]

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class sockaddr(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_address()[source]¶

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class sockaddr_dl(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class socket(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_connection_info()[source]¶

get_converted_connection_info()[source]¶

get_family()[source]¶

get_inpcb()[source]¶

get_protocol_as_string()[source]¶

get_state()[source]¶

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class vm_map_entry(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_object()[source]¶

get_offset()[source]¶

get_path(context, config_prefix)[source]¶

get_perms()[source]¶

get_range_alias()[source]¶

get_special_path()[source]¶

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

get_vnode(context, config_prefix)[source]¶

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

is_suspicious(context, config_prefix)[source]¶: Flags memory regions that are mapped rwx or that map an executable not back from a file on disk.

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class vm_map_object(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_map_object()[source]¶

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class vnode(context, type_name, object_info, size, members)[source]¶

Bases: volatility.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility.framework.interfaces.objects.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

full_path()[source]¶

get_symbol_table()¶

Returns the symbol table for this particular object.

Returns none if the symbol table cannot be identified.

Return type: SymbolTableInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.