volatility3.framework.symbols.linux.extensions package¶

class dentry(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

path()[source]¶

Return type: str

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class files_struct(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_fds()[source]¶

Return type: ObjectInterface

get_max_fds()[source]¶

Return type: ObjectInterface

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class fs_struct(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_root_dentry()[source]¶

get_root_mnt()[source]¶

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class kobject(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

reference_count()[source]¶

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class list_head(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType, collections.abc.Iterable

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

to_list(symbol_type, member, forward=True, sentinel=True, layer=None)[source]¶

Returns an iterator of the entries in the list.

Parameters

symbol_type (str) – Type of the list elements
member (str) – Name of the list_head member in the list elements
forward (bool) – Set false to go backwards
sentinel (bool) – Whether self is a “sentinel node”, meaning it is not embedded in a member of the list
https (Sentinel nodes are NOT yielded. See) – //en.wikipedia.org/wiki/Sentinel_node for further reference
layer (Optional[str]) – Name of layer to read from

Yields

Objects of the type specified via the “symbol_type” argument.

Return type

Iterator[ObjectInterface]

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class mm_struct(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_mmap_iter()[source]¶

Returns an iterator for the mmap list member of an mm_struct.

Return type: Iterable[ObjectInterface]

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class module(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.symbols.generic.GenericIntelProcess

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_core_size()[source]¶

get_init_size()[source]¶

get_module_base()[source]¶

get_module_core()[source]¶

get_module_init()[source]¶

get_name()[source]¶: Get the name of the module as a string

get_sections()[source]¶: Get sections of the module

get_symbol(wanted_sym_name)[source]¶: Get value for a given symbol name

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

get_symbols()[source]¶

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property num_symtab¶

property section_strtab¶

property section_symtab¶

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class mount(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_mnt_flags()[source]¶

get_mnt_mountpoint()[source]¶

get_mnt_parent()[source]¶

get_mnt_root()[source]¶

get_mnt_sb()[source]¶

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class qstr(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

name_as_str()[source]¶

Return type: str

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class struct_file(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_dentry()[source]¶

Return type: ObjectInterface

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

get_vfsmnt()[source]¶

Return type: ObjectInterface

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class super_block(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

MINORBITS = 20¶

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

property major: int¶

Return type: int

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property minor: int¶

Return type: int

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class task_struct(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.symbols.generic.GenericIntelProcess

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

add_process_layer(config_prefix=None, preferred_name=None)[source]¶

Constructs a new layer based on the process’s DTB.

Returns the name of the Layer or None.

Return type: Optional[str]

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_process_memory_sections(heap_only=False)[source]¶

Returns a list of sections based on the memory manager’s view of this task’s virtual memory.

Return type: Generator[Tuple[int, int], None, None]

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class vfsmount(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

get_mnt_mountpoint()[source]¶

get_mnt_parent()[source]¶

get_mnt_root()[source]¶

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

is_valid()[source]¶

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

class vm_area_struct(context, type_name, object_info, size, members)[source]¶

Bases: volatility3.framework.objects.StructType

Constructs an Object adhering to the ObjectInterface.

Parameters

context (ContextInterface) – The context associated with the object
type_name (str) – The name of the type structure for the object
object_info (ObjectInformation) – Basic information relevant to the object (layer, offset, member_name, parent, etc)

class VolTemplateProxy¶

Bases: volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy

classmethod children(template)¶

Method to list children of a template.

Return type: List[Template]

classmethod has_member(template, member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

classmethod relative_child_offset(template, child)¶

Returns the relative offset of a child to its parent.

Return type: int

classmethod replace_child(template, old_child, new_child)¶

Replace a child elements within the arguments handed to the template.

Return type: None

classmethod size(template)¶

Method to return the size of this type.

Return type: int

cast(new_type_name, **additional)¶

Returns a new object at the offset and from the layer that the current object inhabits.

Note

If new type name does not include a symbol table, the symbol table for the current object is used

Return type: ObjectInterface

extended_flags = {1: 'VM_READ', 2: 'VM_WRITE', 4: 'VM_EXEC', 8: 'VM_SHARED', 16: 'VM_MAYREAD', 32: 'VM_MAYWRITE', 64: 'VM_MAYEXEC', 128: 'VM_MAYSHARE', 256: 'VM_GROWSDOWN', 512: 'VM_NOHUGEPAGE', 1024: 'VM_PFNMAP', 2048: 'VM_DENYWRITE', 4096: 'VM_EXECUTABLE', 8192: 'VM_LOCKED', 16384: 'VM_IO', 32768: 'VM_SEQ_READ', 65536: 'VM_RAND_READ', 131072: 'VM_DONTCOPY', 262144: 'VM_DONTEXPAND', 524288: 'VM_RESERVED', 1048576: 'VM_ACCOUNT', 2097152: 'VM_NORESERVE', 4194304: 'VM_HUGETLB', 8388608: 'VM_NONLINEAR', 16777216: 'VM_MAPPED_COP__VM_HUGEPAGE', 33554432: 'VM_INSERTPAGE', 67108864: 'VM_ALWAYSDUMP', 134217728: 'VM_CAN_NONLINEAR', 268435456: 'VM_MIXEDMAP', 536870912: 'VM_SAO', 1073741824: 'VM_PFN_AT_MMAP', 2147483648: 'VM_MERGEABLE'}¶

get_flags()[source]¶

Return type: str

get_name(context, task)[source]¶

get_page_offset()[source]¶

Return type: int

get_protection()[source]¶

Return type: str

get_symbol_table_name()¶

Returns the symbol table name for this particular object.

Raises

ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context

Return type

str

has_member(member_name)¶

Returns whether the object would contain a member called member_name.

Return type: bool

has_valid_member(member_name)¶

Returns whether the dereferenced type has a valid member.

Parameters: member_name (str) – Name of the member to test access to determine if the member is valid or not
Return type: bool

has_valid_members(member_names)¶

Returns whether the object has all of the members listed in member_names

Parameters: member_names (List[str]) – List of names to test as to members with those names validity
Return type: bool

is_suspicious()[source]¶

member(attr='member')¶

Specifically named method for retrieving members.

Return type: object

perm_flags = {1: 'r', 2: 'w', 4: 'x'}¶

property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶

Returns the volatility specific object information.

Return type: ReadOnlyMapping

write(value)¶: Writes the new value into the format at the offset the object currently resides at.

volatility3.framework.symbols.linux.extensions package¶

Submodules¶