volatility3.framework.symbols.windows.extensions.services module¶
- class SERVICE_HEADER(context, type_name, object_info, size, members)[source]¶
Bases:
volatility3.framework.objects.StructType
A service header structure.
Constructs an Object adhering to the ObjectInterface.
- Parameters
context (
ContextInterface
) – The context associated with the objecttype_name (
str
) – The name of the type structure for the objectobject_info (
ObjectInformation
) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy¶
Bases:
volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy
- classmethod has_member(template, member_name)¶
Returns whether the object would contain a member called member_name.
- Return type
- classmethod relative_child_offset(template, child)¶
Returns the relative offset of a child to its parent.
- Return type
- classmethod replace_child(template, old_child, new_child)¶
Replace a child elements within the arguments handed to the template.
- Return type
- cast(new_type_name, **additional)¶
Returns a new object at the offset and from the layer that the current object inhabits.
Note
If new type name does not include a symbol table, the symbol table for the current object is used
- Return type
- get_symbol_table_name()¶
Returns the symbol table name for this particular object.
- Raises
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type
- has_member(member_name)¶
Returns whether the object would contain a member called member_name.
- Return type
- has_valid_member(member_name)¶
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)¶
Returns whether the object has all of the members listed in member_names
- property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶
Returns the volatility specific object information.
- Return type
- write(value)¶
Writes the new value into the format at the offset the object currently resides at.
- class SERVICE_RECORD(context, type_name, object_info, size, members)[source]¶
Bases:
volatility3.framework.objects.StructType
A service record structure.
Constructs an Object adhering to the ObjectInterface.
- Parameters
context (
ContextInterface
) – The context associated with the objecttype_name (
str
) – The name of the type structure for the objectobject_info (
ObjectInformation
) – Basic information relevant to the object (layer, offset, member_name, parent, etc)
- class VolTemplateProxy¶
Bases:
volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy
- classmethod has_member(template, member_name)¶
Returns whether the object would contain a member called member_name.
- Return type
- classmethod relative_child_offset(template, child)¶
Returns the relative offset of a child to its parent.
- Return type
- classmethod replace_child(template, old_child, new_child)¶
Replace a child elements within the arguments handed to the template.
- Return type
- cast(new_type_name, **additional)¶
Returns a new object at the offset and from the layer that the current object inhabits.
Note
If new type name does not include a symbol table, the symbol table for the current object is used
- Return type
- get_symbol_table_name()¶
Returns the symbol table name for this particular object.
- Raises
ValueError – If the object’s symbol does not contain an explicit table
KeyError – If the table_name is not valid within the object’s context
- Return type
- has_member(member_name)¶
Returns whether the object would contain a member called member_name.
- Return type
- has_valid_member(member_name)¶
Returns whether the dereferenced type has a valid member.
- has_valid_members(member_names)¶
Returns whether the object has all of the members listed in member_names
- property vol: volatility3.framework.interfaces.objects.ReadOnlyMapping¶
Returns the volatility specific object information.
- Return type
- write(value)¶
Writes the new value into the format at the offset the object currently resides at.