当前位置: 首页>>代码示例>>Python>>正文

Python addrspace.AbstractRunBasedMemory方法代码示例

本文整理汇总了Python中volatility.addrspace.AbstractRunBasedMemory方法的典型用法代码示例。如果您正苦于以下问题：Python addrspace.AbstractRunBasedMemory方法的具体用法？Python addrspace.AbstractRunBasedMemory怎么用？Python addrspace.AbstractRunBasedMemory使用的例子？那么恭喜您, 这里精选的方法代码示例或许可以为您提供帮助。您也可以进一步了解该方法所在类volatility.addrspace的用法示例。


在下文中一共展示了addrspace.AbstractRunBasedMemory方法的8个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于系统推荐出更棒的Python代码示例。

示例1: __init__

# 需要导入模块: from volatility import addrspace [as 别名]
# 或者: from volatility.addrspace import AbstractRunBasedMemory [as 别名]
def __init__(self, base, config, *args, **kwargs):
        self.as_assert(base, "mac: need base")

        addrspace.AbstractRunBasedMemory.__init__(self, base, config, *args, **kwargs)

        sig = base.read(0, 4) 

        if sig == '\xce\xfa\xed\xfe':
            self.bits = 32
        elif sig == '\xcf\xfa\xed\xfe':
            self.bits = 64
        else:
            self.as_assert(0, "MachO Header signature invalid")

        self.runs = []

        self.header = None

        self.addr_cache = {}
        self.parse_macho()
开发者ID:virtualrealitysystems，项目名称:aumfor，代码行数:22，代码来源:macho.py

示例2: __init__

# 需要导入模块: from volatility import addrspace [as 别名]
# 或者: from volatility.addrspace import AbstractRunBasedMemory [as 别名]
def __init__(self, base, config, **kwargs):
        ## We must have an AS below us
        self.as_assert(base, "No base Address Space")

        addrspace.AbstractRunBasedMemory.__init__(self, base, config, **kwargs)

        ## Must start with the magic PAGEDUMP
        self.as_assert((base.read(0, 8) == self.dumpsig), "Header signature invalid")

        self.as_assert(self.profile.has_type(self.headertype), self.headertype + " not available in profile")
        self.header = obj.Object(self.headertype, 0, base)

        self.as_assert((self.header.DumpType == 0x1), "Unsupported dump format")

        offset = self.headerpages
        for x in self.header.PhysicalMemoryBlockBuffer.Run:
            self.runs.append((x.BasePage.v() * 0x1000,
                              offset * 0x1000,
                              x.PageCount.v() * 0x1000))
            offset += x.PageCount.v()

        self.dtb = self.header.DirectoryTableBase.v()
开发者ID:virtualrealitysystems，项目名称:aumfor，代码行数:24，代码来源:crash.py

示例3: __init__

# 需要导入模块: from volatility import addrspace [as 别名]
# 或者: from volatility.addrspace import AbstractRunBasedMemory [as 别名]
def __init__(self, base, config, *args, **kwargs):
        self.as_assert(base, "lime: need base")

        addrspace.AbstractRunBasedMemory.__init__(self, base, config, *args, **kwargs)

        sig = base.read(0, 4)

        ## ARM processors are bi-endian, but little is the default and currently
        ## the only mode we support; unless it comes a common request.
        if sig == '\x4c\x69\x4d\x45':
            debug.debug("Big-endian ARM not supported, please submit a feature request")

        self.as_assert(sig == '\x45\x4D\x69\x4c', "Invalid Lime header signature")

        self.addr_cache = {}
        self.parse_lime()
开发者ID:virtualrealitysystems，项目名称:aumfor，代码行数:18，代码来源:lime.py

示例4: __init__

# 需要导入模块: from volatility import addrspace [as 别名]
# 或者: from volatility.addrspace import AbstractRunBasedMemory [as 别名]
def __init__(self, base, config, **kwargs):
        ## We must have an AS below us
        self.as_assert(base, "No base Address Space")
        addrspace.AbstractRunBasedMemory.__init__(self, base, config, **kwargs)

        ## Quick test (before instantiating an object) 
        ## for ELF64, little-endian - ELFCLASS64 and ELFDATA2LSB
        ## for ELF32, little-endian - ELFCLASS32 and ELFDATA2LSB
        self.as_assert(base.read(0, 6) in ['\x7fELF\x02\x01', '\x7fELF\x01\x01'], "ELF Header signature invalid")

        ## Base AS should be a file AS
        elf = obj.Object("elf_hdr", offset = 0, vm = base)

        ## The PT_NOTE core descriptor structure 
        self.header = None

        for phdr in elf.program_headers():

            # Only keep load segments with valid file sizes
            if (str(phdr.p_type) != 'PT_LOAD' or
                    phdr.p_filesz == 0 or
                    phdr.p_filesz != phdr.p_memsz):
                continue

            self.runs.append((int(phdr.p_paddr),
                              int(phdr.p_offset),
                              int(phdr.p_memsz)))

        self.as_assert(len(self.runs) > 0, "No PT_LOAD segments found")
开发者ID:virtualrealitysystems，项目名称:aumfor，代码行数:31，代码来源:osxpmemelf.py

示例5: __init__

# 需要导入模块: from volatility import addrspace [as 别名]
# 或者: from volatility.addrspace import AbstractRunBasedMemory [as 别名]
def __init__(self, base, config, **kwargs):
        ## We must have an AS below us
        self.as_assert(base, "No base Address Space")
        addrspace.AbstractRunBasedMemory.__init__(self, base, config, **kwargs)

        ## Quick test (before instantiating an object) 
        ## for ELF64, little-endian - ELFCLASS64 and ELFDATA2LSB
        ## for ELF32, little-endian - ELFCLASS32 and ELFDATA2LSB
        self.as_assert(base.read(0, 6) in ['\x7fELF\x02\x01', '\x7fELF\x01\x01'], "ELF Header signature invalid")

        ## Base AS should be a file AS
        elf = obj.Object("elf_hdr", offset = 0, vm = base)

        ## Tuple of (physical memory address, file offset, length)
        self.runs = []

        ## The PT_NOTE core descriptor structure 
        self.header = None

        for phdr in elf.program_headers():

            # Only keep load segments with valid file sizes
            if (str(phdr.p_type) != 'PT_LOAD' or
                    phdr.p_filesz == 0 or
                    phdr.p_filesz != phdr.p_memsz):
                continue

            self.runs.append((int(phdr.p_paddr),
                              int(phdr.p_offset),
                              int(phdr.p_memsz)))
开发者ID:504ensicsLabs，项目名称:DAMM，代码行数:32，代码来源:osxpmemelf.py

示例6: __init__

# 需要导入模块: from volatility import addrspace [as 别名]
# 或者: from volatility.addrspace import AbstractRunBasedMemory [as 别名]
def __init__(self, base, config, **kwargs):
        ## We must have an AS below us
        self.as_assert(base, "No base Address Space")
        addrspace.AbstractRunBasedMemory.__init__(self, base, config, **kwargs)

        ## Quick test (before instantiating an object) 
        ## for ELF64, little-endian - ELFCLASS64 and ELFDATA2LSB
        ## for ELF32, little-endian - ELFCLASS32 and ELFDATA2LSB
        self.as_assert(base.read(0, 6) in ['\x7fELF\x02\x01', '\x7fELF\x01\x01'], "ELF Header signature invalid")

        ## Base AS should be a file AS
        elf = obj.Object("elf_hdr", offset = 0, vm = base)

        ## The PT_NOTE core descriptor structure 
        self.header = None

        for phdr in elf.program_headers():

            # Only keep load segments with valid file sizes
            if (str(phdr.p_type) != 'PT_LOAD' or
                    phdr.p_filesz == 0 or
                    phdr.p_filesz != phdr.p_memsz):
                continue

            self.runs.append((int(phdr.p_paddr),
                              int(phdr.p_offset),
                              int(phdr.p_memsz)))
开发者ID:botherder，项目名称:volatility，代码行数:29，代码来源:osxpmemelf.py

示例7: __init__

# 需要导入模块: from volatility import addrspace [as 别名]
# 或者: from volatility.addrspace import AbstractRunBasedMemory [as 别名]
def __init__(self, base, config, **kwargs):
        self.as_assert(base == None, 'Must be first Address Space')
        addrspace.AbstractRunBasedMemory.__init__(self, base, config, **kwargs)		

        self.fhandle = win32file.CreateFile(
            "\\\\.\\pmem",
            win32file.GENERIC_READ | win32file.GENERIC_WRITE,
            win32file.FILE_SHARE_READ | win32file.FILE_SHARE_WRITE,
            None,
            win32file.OPEN_EXISTING,
            win32file.FILE_ATTRIBUTE_NORMAL,
            None)
			
        self.ParseMemoryRuns()
开发者ID:botherder，项目名称:volatility，代码行数:16，代码来源:win32pmem.py

示例8: __init__

# 需要导入模块: from volatility import addrspace [as 别名]
# 或者: from volatility.addrspace import AbstractRunBasedMemory [as 别名]
def __init__(self, base, config, **kwargs):
        ## We must have an AS below us
        self.as_assert(base, "No base Address Space")
        addrspace.AbstractRunBasedMemory.__init__(self, base, config, **kwargs)

        ## Quick test (before instantiating an object) 
        ## for ELF64, little-endian - ELFCLASS64 and ELFDATA2LSB
        ## for ELF32, little-endian - ELFCLASS32 and ELFDATA2LSB
        self.as_assert(base.read(0, 6) in ['\x7fELF\x02\x01', '\x7fELF\x01\x01'], 
                       "ELF Header signature invalid")

        ## Base AS should be a file AS
        elf = obj.Object("elf_hdr", offset = 0, vm = base)

        ## Make sure its a core dump
        self.as_assert(str(elf.e_type) == 'ET_CORE',
                       "ELF type is not a Core file")

        ## Tuple of (physical memory address, file offset, length)
        self.runs = []

        ## The PT_NOTE core descriptor structure 
        self.header = None

        for phdr in elf.program_headers():

            ## The first note should be the VBCORE segment 
            if str(phdr.p_type) == 'PT_NOTE':
                note = obj.Object("elf_note", offset = phdr.p_offset, vm = base, parent = phdr)

                self.check_note(note)
                continue

            # Only keep load segments with valid file sizes
            if (str(phdr.p_type) != 'PT_LOAD' or
                    phdr.p_filesz == 0 or
                    phdr.p_filesz != phdr.p_memsz):
                continue

            self.runs.append((int(phdr.p_paddr),
                              int(phdr.p_offset),
                              int(phdr.p_memsz)))

        self.validate()
开发者ID:virtualrealitysystems，项目名称:aumfor，代码行数:46，代码来源:elfcoredump.py


注：本文中的volatility.addrspace.AbstractRunBasedMemory方法示例由纯净天空整理自Github/MSDocs等开源代码及文档管理平台，相关代码片段筛选自各路编程大神贡献的开源项目，源码版权归原作者所有，传播和使用请参考对应项目的License；未经允许，请勿转载。