volatility3.framework.symbols.windows.extensions package
- class CONTROL_AREA(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA class for _CONTROL_AREA structures
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- PAGE_MASK = 4095
- PAGE_SIZE = 4096
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_available_pages()[source]
Get the available pages that correspond to a cached file.
The tuples generated are (physical_offset, file_offset, page_size).
- get_subsection()[source]
Get the Subsection object, which is found immediately after the _CONTROL_AREA.
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class DEVICE_OBJECT(context, type_name, object_info, size, members)[source]
Bases:
StructType,ExecutiveObjectA class for kernel device objects.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_object_header()
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class DRIVER_OBJECT(context, type_name, object_info, size, members)[source]
Bases:
StructType,ExecutiveObjectA class for kernel driver objects.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_object_header()
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class EPROCESS(context, type_name, object_info, size, members)[source]
Bases:
GenericIntelProcess,ExecutiveObjectA class for executive kernel processes objects.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- add_process_layer(config_prefix=None, preferred_name=None)[source]
Constructs a new layer based on the process’s DirectoryTableBase.
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- environment_variables()[source]
Generator for environment variables.
The PEB points to our env block - a series of null-terminated unicode strings. Each string cannot be more than 0x7FFF chars. End of the list is a quad-null.
- get_object_header()
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- init_order_modules()[source]
Generator for DLLs in the order that they were initialized
- Return type:
- mem_order_modules()[source]
Generator for DLLs in the order that they appear in memory
- Return type:
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class ERESOURCE(context, type_name, object_info, size, members)[source]
Bases:
StructTypeConstructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class ETHREAD(context, type_name, object_info, size, members)[source]
Bases:
StructType,ExecutiveObjectA class for executive thread objects.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_object_header()
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class EX_FAST_REF(context, type_name, object_info, size, members)[source]
Bases:
StructTypeThis is a standard Windows structure that stores a pointer to an object but also leverages the least significant bits to encode additional details.
When dereferencing the pointer, we need to strip off the extra bits.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class FILE_OBJECT(context, type_name, object_info, size, members)[source]
Bases:
StructType,ExecutiveObjectA class for windows file objects.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_object_header()
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class KMUTANT(context, type_name, object_info, size, members)[source]
Bases:
StructType,ExecutiveObjectA class for windows mutant objects.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_object_header()
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class KSYSTEM_TIME(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA system time structure that stores a high and low part.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class KTHREAD(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA class for thread control block objects.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class KTIMER(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA class for Kernel Timers
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- VALID_TYPES = {8: 'TimerNotificationObject', 9: 'TimerSynchronizationObject'}
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class LIST_ENTRY(context, type_name, object_info, size, members)[source]
Bases:
StructType,IterableA class for double-linked lists on Windows.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- to_list(symbol_type, member, forward=True, sentinel=True, layer=None)[source]
Returns an iterator of the entries in the list.
- Return type:
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class MMVAD(context, type_name, object_info, size, members)[source]
Bases:
MMVAD_SHORTA version of the process virtual memory range structure that contains additional fields necessary to map files from disk.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- property Protection
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_commit_charge()
Get the VAD’s commit charge (number of committed pages)
- get_end()
Get the VAD’s ending virtual address. This is the last accessible byte in the range.
- Return type:
- get_left_child()
Get the left child member.
- get_parent()
Get the VAD’s parent member.
- get_private_memory()
Get the VAD’s private memory setting.
- get_protection(protect_values, winnt_protections)
Get the VAD’s protection constants as a string.
- get_right_child()
Get the right child member.
- get_start()
Get the VAD’s starting virtual address. This is the first accessible byte in the range.
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- get_tag()
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- traverse(visited=None, depth=0)
Traverse the VAD tree, determining each underlying VAD node type by looking up the pool tag for the structure and then casting into a new object.
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class MMVAD_SHORT(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA class that represents process virtual memory ranges.
Each instance is a node in a binary tree structure and is pointed to by VadRoot.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- property Protection
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_end()[source]
Get the VAD’s ending virtual address. This is the last accessible byte in the range.
- Return type:
- get_protection(protect_values, winnt_protections)[source]
Get the VAD’s protection constants as a string.
- get_start()[source]
Get the VAD’s starting virtual address. This is the first accessible byte in the range.
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- traverse(visited=None, depth=0)[source]
Traverse the VAD tree, determining each underlying VAD node type by looking up the pool tag for the structure and then casting into a new object.
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class OBJECT_SYMBOLIC_LINK(context, type_name, object_info, size, members)[source]
Bases:
StructType,ExecutiveObjectA class for kernel link objects.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_object_header()
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class SHARED_CACHE_MAP(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA class for _SHARED_CACHE_MAP structures
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- VACB_ARRAY = 128
- VACB_BLOCK = 262144
- VACB_LEVEL_SHIFT = 7
- VACB_OFFSET_SHIFT = 18
- VACB_SIZE_OF_FIRST_LEVEL = 33554432
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_available_pages()[source]
Get the available pages that correspond to a cached file.
The lists generated are (virtual_offset, file_offset, page_size).
- Return type:
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- process_index_array(array_pointer, level, limit, vacb_list=None)[source]
Recursively process the sparse multilevel VACB index array.
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class TOKEN(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA class for process etoken object.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class UNICODE_STRING(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA class for Windows unicode string structures.
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- property String: ObjectInterface
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
- class VACB(context, type_name, object_info, size, members)[source]
Bases:
StructTypeA class for _VACB structures
Constructs an Object adhering to the ObjectInterface.
- Parameters:
context (
ContextInterface) – The context associated with the objecttype_name (
str) – The name of the type structure for the objectobject_info (
ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- FILEOFFSET_MASK = 18446744073709486080
- class VolTemplateProxy
Bases:
VolTemplateProxy- classmethod child_template(template, child)
Returns the template of a child to its parent.
- Return type:
- classmethod has_member(template, member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- classmethod relative_child_offset(template, child)
Returns the relative offset of a child to its parent.
- Return type:
- classmethod replace_child(template, old_child, new_child)
Replace a child elements within the arguments handed to the template.
- Return type:
- cast(new_type_name, **additional)
Returns a new object at the offset and from the layer that the current object inhabits. :rtype:
ObjectInterfaceNote
If new type name does not include a symbol table, the symbol table for the current object is used
- get_symbol_table_name()
Returns the symbol table name for this particular object.
- Raises:
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type:
- has_member(member_name)
Returns whether the object would contain a member called member_name.
- Return type:
- has_valid_member(member_name)
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)
Returns whether the object has all of the members listed in member_names
- property vol: ReadOnlyMapping
Returns the volatility specific object information.
- write(value)
Writes the new value into the format at the offset the object currently resides at.
Submodules
- volatility3.framework.symbols.windows.extensions.callbacks module
- volatility3.framework.symbols.windows.extensions.consoles module
ALIASCOMMANDCOMMAND_HISTORYCOMMAND_HISTORY.CommandCountCOMMAND_HISTORY.ProcessHandleCOMMAND_HISTORY.VolTemplateProxyCOMMAND_HISTORY.cast()COMMAND_HISTORY.get_application()COMMAND_HISTORY.get_commands()COMMAND_HISTORY.get_symbol_table_name()COMMAND_HISTORY.has_member()COMMAND_HISTORY.has_valid_member()COMMAND_HISTORY.has_valid_members()COMMAND_HISTORY.is_valid()COMMAND_HISTORY.member()COMMAND_HISTORY.scan_command_bucket()COMMAND_HISTORY.volCOMMAND_HISTORY.write()
CONSOLE_INFORMATIONCONSOLE_INFORMATION.ScreenBufferCONSOLE_INFORMATION.VolTemplateProxyCONSOLE_INFORMATION.VolTemplateProxy.child_template()CONSOLE_INFORMATION.VolTemplateProxy.children()CONSOLE_INFORMATION.VolTemplateProxy.has_member()CONSOLE_INFORMATION.VolTemplateProxy.relative_child_offset()CONSOLE_INFORMATION.VolTemplateProxy.replace_child()CONSOLE_INFORMATION.VolTemplateProxy.size()
CONSOLE_INFORMATION.cast()CONSOLE_INFORMATION.get_exe_aliases()CONSOLE_INFORMATION.get_histories()CONSOLE_INFORMATION.get_original_title()CONSOLE_INFORMATION.get_processes()CONSOLE_INFORMATION.get_screens()CONSOLE_INFORMATION.get_symbol_table_name()CONSOLE_INFORMATION.get_title()CONSOLE_INFORMATION.has_member()CONSOLE_INFORMATION.has_valid_member()CONSOLE_INFORMATION.has_valid_members()CONSOLE_INFORMATION.is_valid()CONSOLE_INFORMATION.member()CONSOLE_INFORMATION.volCONSOLE_INFORMATION.write()
EXE_ALIAS_LISTEXE_ALIAS_LIST.VolTemplateProxyEXE_ALIAS_LIST.cast()EXE_ALIAS_LIST.get_aliases()EXE_ALIAS_LIST.get_exename()EXE_ALIAS_LIST.get_symbol_table_name()EXE_ALIAS_LIST.has_member()EXE_ALIAS_LIST.has_valid_member()EXE_ALIAS_LIST.has_valid_members()EXE_ALIAS_LIST.member()EXE_ALIAS_LIST.volEXE_ALIAS_LIST.write()
ROWSCREEN_INFORMATIONSCREEN_INFORMATION.ScreenXSCREEN_INFORMATION.ScreenYSCREEN_INFORMATION.VolTemplateProxySCREEN_INFORMATION.VolTemplateProxy.child_template()SCREEN_INFORMATION.VolTemplateProxy.children()SCREEN_INFORMATION.VolTemplateProxy.has_member()SCREEN_INFORMATION.VolTemplateProxy.relative_child_offset()SCREEN_INFORMATION.VolTemplateProxy.replace_child()SCREEN_INFORMATION.VolTemplateProxy.size()
SCREEN_INFORMATION.cast()SCREEN_INFORMATION.get_buffer()SCREEN_INFORMATION.get_symbol_table_name()SCREEN_INFORMATION.has_member()SCREEN_INFORMATION.has_valid_member()SCREEN_INFORMATION.has_valid_members()SCREEN_INFORMATION.member()SCREEN_INFORMATION.volSCREEN_INFORMATION.write()
- volatility3.framework.symbols.windows.extensions.crash module
SUMMARY_DUMPSUMMARY_DUMP.VolTemplateProxySUMMARY_DUMP.cast()SUMMARY_DUMP.get_buffer()SUMMARY_DUMP.get_buffer_char()SUMMARY_DUMP.get_buffer_long()SUMMARY_DUMP.get_symbol_table_name()SUMMARY_DUMP.has_member()SUMMARY_DUMP.has_valid_member()SUMMARY_DUMP.has_valid_members()SUMMARY_DUMP.member()SUMMARY_DUMP.volSUMMARY_DUMP.write()
- volatility3.framework.symbols.windows.extensions.kdbg module
KDDEBUGGER_DATA64KDDEBUGGER_DATA64.VolTemplateProxyKDDEBUGGER_DATA64.cast()KDDEBUGGER_DATA64.get_build_lab()KDDEBUGGER_DATA64.get_csdversion()KDDEBUGGER_DATA64.get_symbol_table_name()KDDEBUGGER_DATA64.has_member()KDDEBUGGER_DATA64.has_valid_member()KDDEBUGGER_DATA64.has_valid_members()KDDEBUGGER_DATA64.member()KDDEBUGGER_DATA64.volKDDEBUGGER_DATA64.write()
- volatility3.framework.symbols.windows.extensions.mbr module
PARTITION_ENTRYPARTITION_ENTRY.VolTemplateProxyPARTITION_ENTRY.cast()PARTITION_ENTRY.get_bootable_flag()PARTITION_ENTRY.get_ending_chs()PARTITION_ENTRY.get_ending_cylinder()PARTITION_ENTRY.get_ending_sector()PARTITION_ENTRY.get_partition_type()PARTITION_ENTRY.get_size_in_sectors()PARTITION_ENTRY.get_starting_chs()PARTITION_ENTRY.get_starting_cylinder()PARTITION_ENTRY.get_starting_lba()PARTITION_ENTRY.get_starting_sector()PARTITION_ENTRY.get_symbol_table_name()PARTITION_ENTRY.has_member()PARTITION_ENTRY.has_valid_member()PARTITION_ENTRY.has_valid_members()PARTITION_ENTRY.is_bootable()PARTITION_ENTRY.member()PARTITION_ENTRY.volPARTITION_ENTRY.write()
PARTITION_TABLEPARTITION_TABLE.VolTemplateProxyPARTITION_TABLE.cast()PARTITION_TABLE.get_disk_signature()PARTITION_TABLE.get_symbol_table_name()PARTITION_TABLE.has_member()PARTITION_TABLE.has_valid_member()PARTITION_TABLE.has_valid_members()PARTITION_TABLE.member()PARTITION_TABLE.volPARTITION_TABLE.write()
- volatility3.framework.symbols.windows.extensions.mft module
MFTAttributeMFTAttribute.VolTemplateProxyMFTAttribute.cast()MFTAttribute.get_resident_filecontent()MFTAttribute.get_resident_filename()MFTAttribute.get_symbol_table_name()MFTAttribute.has_member()MFTAttribute.has_valid_member()MFTAttribute.has_valid_members()MFTAttribute.member()MFTAttribute.volMFTAttribute.write()
MFTEntryMFTFileName
- volatility3.framework.symbols.windows.extensions.network module
- volatility3.framework.symbols.windows.extensions.pe module
IMAGE_DOS_HEADERIMAGE_DOS_HEADER.VolTemplateProxyIMAGE_DOS_HEADER.cast()IMAGE_DOS_HEADER.fix_image_base()IMAGE_DOS_HEADER.get_nt_header()IMAGE_DOS_HEADER.get_symbol_table_name()IMAGE_DOS_HEADER.has_member()IMAGE_DOS_HEADER.has_valid_member()IMAGE_DOS_HEADER.has_valid_members()IMAGE_DOS_HEADER.member()IMAGE_DOS_HEADER.reconstruct()IMAGE_DOS_HEADER.replace_header_field()IMAGE_DOS_HEADER.volIMAGE_DOS_HEADER.write()
IMAGE_NT_HEADERSIMAGE_NT_HEADERS.VolTemplateProxyIMAGE_NT_HEADERS.cast()IMAGE_NT_HEADERS.get_sections()IMAGE_NT_HEADERS.get_symbol_table_name()IMAGE_NT_HEADERS.has_member()IMAGE_NT_HEADERS.has_valid_member()IMAGE_NT_HEADERS.has_valid_members()IMAGE_NT_HEADERS.member()IMAGE_NT_HEADERS.volIMAGE_NT_HEADERS.write()
- volatility3.framework.symbols.windows.extensions.pool module
ExecutiveObjectOBJECT_HEADEROBJECT_HEADER.NameInfoOBJECT_HEADER.VolTemplateProxyOBJECT_HEADER.cast()OBJECT_HEADER.get_object_type()OBJECT_HEADER.get_symbol_table_name()OBJECT_HEADER.has_member()OBJECT_HEADER.has_valid_member()OBJECT_HEADER.has_valid_members()OBJECT_HEADER.is_valid()OBJECT_HEADER.member()OBJECT_HEADER.volOBJECT_HEADER.write()
POOL_HEADERPOOL_HEADER.VolTemplateProxyPOOL_HEADER.cast()POOL_HEADER.get_object()POOL_HEADER.get_symbol_table_name()POOL_HEADER.has_member()POOL_HEADER.has_valid_member()POOL_HEADER.has_valid_members()POOL_HEADER.is_free_pool()POOL_HEADER.is_nonpaged_pool()POOL_HEADER.is_paged_pool()POOL_HEADER.member()POOL_HEADER.volPOOL_HEADER.write()
POOL_HEADER_VISTAPOOL_HEADER_VISTA.VolTemplateProxyPOOL_HEADER_VISTA.cast()POOL_HEADER_VISTA.get_object()POOL_HEADER_VISTA.get_symbol_table_name()POOL_HEADER_VISTA.has_member()POOL_HEADER_VISTA.has_valid_member()POOL_HEADER_VISTA.has_valid_members()POOL_HEADER_VISTA.is_free_pool()POOL_HEADER_VISTA.is_nonpaged_pool()POOL_HEADER_VISTA.is_paged_pool()POOL_HEADER_VISTA.member()POOL_HEADER_VISTA.volPOOL_HEADER_VISTA.write()
POOL_TRACKER_BIG_PAGESPOOL_TRACKER_BIG_PAGES.VolTemplateProxyPOOL_TRACKER_BIG_PAGES.VolTemplateProxy.child_template()POOL_TRACKER_BIG_PAGES.VolTemplateProxy.children()POOL_TRACKER_BIG_PAGES.VolTemplateProxy.has_member()POOL_TRACKER_BIG_PAGES.VolTemplateProxy.relative_child_offset()POOL_TRACKER_BIG_PAGES.VolTemplateProxy.replace_child()POOL_TRACKER_BIG_PAGES.VolTemplateProxy.size()
POOL_TRACKER_BIG_PAGES.cast()POOL_TRACKER_BIG_PAGES.get_key()POOL_TRACKER_BIG_PAGES.get_number_of_bytes()POOL_TRACKER_BIG_PAGES.get_pool_type()POOL_TRACKER_BIG_PAGES.get_symbol_table_name()POOL_TRACKER_BIG_PAGES.has_member()POOL_TRACKER_BIG_PAGES.has_valid_member()POOL_TRACKER_BIG_PAGES.has_valid_members()POOL_TRACKER_BIG_PAGES.is_free()POOL_TRACKER_BIG_PAGES.is_valid()POOL_TRACKER_BIG_PAGES.member()POOL_TRACKER_BIG_PAGES.pool_type_lookupPOOL_TRACKER_BIG_PAGES.volPOOL_TRACKER_BIG_PAGES.write()
- volatility3.framework.symbols.windows.extensions.registry module
CMHIVECM_KEY_BODYCM_KEY_NODECM_KEY_NODE.VolTemplateProxyCM_KEY_NODE.cast()CM_KEY_NODE.get_key_path()CM_KEY_NODE.get_name()CM_KEY_NODE.get_subkeys()CM_KEY_NODE.get_symbol_table_name()CM_KEY_NODE.get_values()CM_KEY_NODE.get_volatile()CM_KEY_NODE.has_member()CM_KEY_NODE.has_valid_member()CM_KEY_NODE.has_valid_members()CM_KEY_NODE.member()CM_KEY_NODE.volCM_KEY_NODE.write()
CM_KEY_VALUECM_KEY_VALUE.VolTemplateProxyCM_KEY_VALUE.cast()CM_KEY_VALUE.decode_data()CM_KEY_VALUE.get_name()CM_KEY_VALUE.get_symbol_table_name()CM_KEY_VALUE.get_type()CM_KEY_VALUE.has_member()CM_KEY_VALUE.has_valid_member()CM_KEY_VALUE.has_valid_members()CM_KEY_VALUE.member()CM_KEY_VALUE.volCM_KEY_VALUE.write()
HMAP_ENTRYRegKeyFlagsRegKeyFlags.KEY_COMP_NAMERegKeyFlags.KEY_HIVE_ENTRYRegKeyFlags.KEY_HIVE_EXITRegKeyFlags.KEY_IS_VOLATILERegKeyFlags.KEY_NO_DELETERegKeyFlags.KEY_PREFEF_HANDLERegKeyFlags.KEY_SYM_LINKRegKeyFlags.KEY_VIRTUAL_STORERegKeyFlags.KEY_VIRT_MIRROREDRegKeyFlags.KEY_VIRT_TARGETRegKeyFlags.as_integer_ratio()RegKeyFlags.bit_count()RegKeyFlags.bit_length()RegKeyFlags.conjugate()RegKeyFlags.denominatorRegKeyFlags.from_bytes()RegKeyFlags.imagRegKeyFlags.numeratorRegKeyFlags.realRegKeyFlags.to_bytes()
RegValueTypesRegValueTypes.REG_BINARYRegValueTypes.REG_DWORDRegValueTypes.REG_DWORD_BIG_ENDIANRegValueTypes.REG_EXPAND_SZRegValueTypes.REG_FULL_RESOURCE_DESCRIPTORRegValueTypes.REG_LINKRegValueTypes.REG_MULTI_SZRegValueTypes.REG_NONERegValueTypes.REG_QWORDRegValueTypes.REG_RESOURCE_LISTRegValueTypes.REG_RESOURCE_REQUIREMENTS_LISTRegValueTypes.REG_SZRegValueTypes.REG_UNKNOWN
- volatility3.framework.symbols.windows.extensions.services module
SERVICE_HEADERSERVICE_RECORDSERVICE_RECORD.VolTemplateProxySERVICE_RECORD.cast()SERVICE_RECORD.get_binary()SERVICE_RECORD.get_display()SERVICE_RECORD.get_name()SERVICE_RECORD.get_pid()SERVICE_RECORD.get_symbol_table_name()SERVICE_RECORD.get_type()SERVICE_RECORD.has_member()SERVICE_RECORD.has_valid_member()SERVICE_RECORD.has_valid_members()SERVICE_RECORD.is_valid()SERVICE_RECORD.member()SERVICE_RECORD.traverse()SERVICE_RECORD.volSERVICE_RECORD.write()
- volatility3.framework.symbols.windows.extensions.shimcache module
RTL_AVL_TABLESHIM_CACHE_ENTRYSHIM_CACHE_ENTRY.VolTemplateProxySHIM_CACHE_ENTRY.cast()SHIM_CACHE_ENTRY.exec_flagSHIM_CACHE_ENTRY.file_pathSHIM_CACHE_ENTRY.file_sizeSHIM_CACHE_ENTRY.get_symbol_table_name()SHIM_CACHE_ENTRY.has_member()SHIM_CACHE_ENTRY.has_valid_member()SHIM_CACHE_ENTRY.has_valid_members()SHIM_CACHE_ENTRY.is_valid()SHIM_CACHE_ENTRY.last_modifiedSHIM_CACHE_ENTRY.last_updateSHIM_CACHE_ENTRY.member()SHIM_CACHE_ENTRY.volSHIM_CACHE_ENTRY.write()
SHIM_CACHE_HANDLESHIM_CACHE_HANDLE.VolTemplateProxySHIM_CACHE_HANDLE.cast()SHIM_CACHE_HANDLE.get_symbol_table_name()SHIM_CACHE_HANDLE.has_member()SHIM_CACHE_HANDLE.has_valid_member()SHIM_CACHE_HANDLE.has_valid_members()SHIM_CACHE_HANDLE.headSHIM_CACHE_HANDLE.is_valid()SHIM_CACHE_HANDLE.member()SHIM_CACHE_HANDLE.volSHIM_CACHE_HANDLE.write()