Module Expr Str Import alias alias Import alias ImportFrom alias identifier ImportFrom alias ImportFrom alias ImportFrom alias Import alias Import alias Import alias Import alias Import alias TryExcept body ImportFrom alias handlers ExceptHandler type NameLoad body ImportFrom alias FunctionDef arguments args defaults body Expr Str Print Str Expr Call AttributeLoad NameLoad attr Num decorator_list ClassDef bases NameLoad body Expr Str FunctionDef arguments args NameParam defaults body Expr Str Expr Call AttributeLoad Call AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr Str decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str Assign NameStore SubscriptLoad SubscriptLoad NameLoad Index Str Index Str Assign NameStore Call NameLoad NameLoad Assign NameStore Call NameLoad keyword NameLoad Expr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr keyword NameLoad Return Call AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Expr Str Assign NameStore Dict For TupleStore NameStore NameStore Call AttributeLoad NameLoad attr body If UnaryOpNot NameLoad body Assign NameStore Str orelse If Call NameLoad NameLoad NameLoad body Assign NameStore SubscriptLoad NameLoad Index Num orelse If Call NameLoad NameLoad NameLoad body If CompareIn Str NameLoad body If CompareIn Str SubscriptLoad NameLoad Index Str body Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr SubscriptLoad NameLoad Index Str If CompareEq NameLoad Call AttributeLoad NameLoad attr Num Num Num Num Num body Assign NameStore Str Assign SubscriptStore NameLoad Index SubscriptLoad NameLoad Index NameLoad NameLoad Return NameLoad decorator_list NameLoad decorator_list ClassDef bases AttributeLoad NameLoad attr body Expr Str FunctionDef arguments args NameParam NameParam NameParam defaults NameLoad body Expr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad Str Assign NameStore Str Assign NameStore ListLoad NameLoad NameLoad Expr Call AttributeLoad Call NameLoad NameLoad NameLoad attr keyword NameLoad Assign NameStore Call NameLoad NameLoad Assign AttributeStore NameLoad attr Call AttributeLoad NameLoad attr keyword NameLoad keyword NameLoad Expr Call AttributeLoad NameLoad attr Str decorator_list decorator_list ClassDef bases NameLoad body Expr Str FunctionDef arguments args NameParam NameParam defaults body Expr Str Assign AttributeStore AttributeLoad NameLoad attr attr Str Assign AttributeStore NameLoad attr ListLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Dict Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call AttributeLoad Call NameLoad NameLoad NameLoad attr keyword NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults NameLoad NameLoad body Expr Str Assign AttributeStore NameLoad attr ListLoad Expr Call AttributeLoad Call NameLoad NameLoad NameLoad attr keyword NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults vararg body Expr Str If AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr ListLoad Str Dict Str NameLoad Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad kwarg body Expr Str If UnaryOpNot NameLoad body Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str Assign NameStore SubscriptLoad NameLoad Index Num Assign NameStore SubscriptLoad NameLoad Index Num Expr Call AttributeLoad AttributeLoad NameLoad attr attr Dict Str Str NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam defaults NameLoad NameLoad Str body Expr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad NameLoad Return Call NameLoad NameLoad NameLoad decorator_list decorator_list FunctionDef arguments args defaults body Expr Str Import alias Assign NameStore Call AttributeLoad NameLoad attr keyword Num keyword Num Expr Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad Str If UnaryOpNot Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad body Print Str Import alias Expr Call AttributeLoad NameLoad attr Str NameLoad If UnaryOpNot Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad body Print Str Print Str Expr Call NameLoad Num Assign NameStore Call AttributeLoad NameLoad attr Call AttributeLoad Call NameLoad NameLoad Str attr Str Str Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Call NameLoad Print Str Expr Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr NameLoad decorator_list If CompareEq NameLoad Str body Expr Call NameLoad
N/A N/A rekall_adapter: Helps Workbench utilize the Rekall Memory Forensic Framework.
    See Google Github: http://github.com/google/rekall
    All credit for good stuff goes to them, all credit for bad stuff goes to us. :).
 N/A os sys N/A logging rekall session rekall_session rekall.plugins.addrspaces standard rekall.plugins.renderers.data_export DataExportRenderer rekall.ui.json_renderer JsonEncoder N/A collections N/A datetime N/A pprint N/A pytz N/A gevent N/A N/A cStringIO StringIO N/A N/A N/A ImportError N/A StringIO StringIO gsleep N/A N/A N/A N/A N/A  Convenience method for gevent.sleep  N/A *** Gevent Sleep *** N/A N/A N/A gevent sleep 0 N/A RekallAdapter N/A object N/A N/A RekallAdapter: Helps utilize the Rekall Memory Forensic Framework. __init__ N/A N/A self N/A N/A N/A Initialization. N/A N/A N/A N/A N/A logging getLogger setLevel N/A logging ERROR N/A N/A self plugin_name imageinfo N/A set_plugin_name N/A N/A self name N/A N/A N/A  Set the name of the plugin to be used  N/A N/A self plugin_name name N/A execute N/A N/A self input_data N/A N/A N/A  Execute method  N/A raw_bytes N/A N/A input_data N/A sample N/A raw_bytes N/A session N/A MemSession raw_bytes N/A renderer N/A WorkbenchRenderer session session N/A N/A N/A session RunPlugin N/A self plugin_name renderer renderer N/A N/A N/A renderer get_output N/A process_row N/A N/A cls data column_map N/A N/A N/A Process the row data from Rekall N/A row N/A N/A N/A key value N/A N/A data iteritems N/A N/A N/A value N/A N/A value - N/A N/A N/A isinstance value list N/A N/A value N/A value N/A 1 N/A N/A N/A isinstance value dict N/A N/A N/A type_name value N/A N/A N/A UnixTimeStamp N/A value N/A type_name N/A N/A value N/A N/A N/A datetime datetime utcfromtimestamp N/A value N/A epoch N/A N/A value N/A N/A datetime datetime 1970 1 1 0 0 N/A N/A value - N/A N/A row N/A N/A column_map N/A key value N/A row N/A classmethod N/A MemSession N/A N/A rekall_session JsonSerializableSession N/A N/A MemSession: Helps utilize the Rekall Memory Forensic Framework. __init__ N/A N/A self raw_bytes fhandle N/A None N/A N/A Create a Rekall session for this memory image (raw_bytes) N/A local N/A N/A N/A os path join N/A N/A N/A os path dirname N/A N/A N/A os path realpath __file__ profiles N/A remote http://profiles.rekall-forensic.com N/A profile_path N/A local remote N/A N/A N/A N/A super MemSession self __init__ profile_path profile_path N/A mem_file N/A StringIO raw_bytes N/A N/A self physical_address_space N/A N/A standard FDAddressSpace fhandle mem_file session self N/A N/A N/A self GetParameter profile N/A N/A WorkbenchRenderer N/A DataExportRenderer N/A N/A Workbench Renderer: Extends DataExportRenderer and simply populates local python
        data structures, not meant to be serialized or sent over the network. __init__ N/A N/A self session N/A N/A N/A Initialize the WorkbenchRenderer class N/A N/A N/A self __class__ __name__ DataExportRenderer N/A N/A self output N/A N/A N/A self session session N/A N/A self column_map N/A N/A N/A self current_table_name unknown N/A N/A self verbose False N/A N/A self incoming_section False N/A N/A N/A N/A super WorkbenchRenderer self __init__ session session N/A get_output N/A N/A self N/A N/A N/A N/A self output N/A start N/A N/A self plugin_name kwargs N/A None None N/A N/A Start method: initial data structures and store some meta data. N/A N/A self output N/A N/A N/A N/A N/A super WorkbenchRenderer self start plugin_name plugin_name N/A self N/A format N/A N/A self formatstring N/A args N/A N/A Presentation Information from the Plugin N/A N/A self incoming_section N/A N/A N/A N/A self SendMessage N/A s N/A name args N/A N/A self incoming_section False N/A section N/A N/A self name N/A None _kwargs N/A N/A Called by the plugin when a new section is output N/A N/A name N/A N/A N/A self incoming_section True N/A SendMessage N/A N/A self statement N/A N/A N/A Here we're actually capturing messages and putting them into our output N/A message_type N/A statement N/A 0 N/A message_data N/A statement N/A 1 N/A N/A N/A N/A self output append N/A type data message_type message_data N/A open N/A N/A self directory filename mode N/A None None rb N/A N/A Opens a file for writing or reading. N/A path N/A N/A N/A os path join directory filename N/A N/A open path mode N/A N/A test N/A N/A N/A N/A N/A  rekall_adapter.py: Test  N/A zerorpc N/A c N/A N/A zerorpc Client timeout 300 heartbeat 60 N/A N/A N/A c connect tcp://127.0.0.1:4242 N/A data_path N/A N/A N/A os path join N/A N/A N/A os path dirname N/A N/A N/A os path realpath __file__ ../../data/memory_images/exemplar4.vmem N/A N/A N/A N/A N/A os path isfile data_path N/A N/A Not finding exemplar4.mem... Downloading now... N/A urllib N/A N/A N/A urllib urlretrieve http://s3-us-west-2.amazonaws.com/workbench-data/memory_images/exemplar4.vmem data_path N/A N/A N/A N/A N/A os path isfile data_path N/A N/A Downloading failed, try it manually... N/A wget http://s3-us-west-2.amazonaws.com/workbench-data/memory_images/exemplar4.vmem N/A N/A exit 1 N/A md5 N/A N/A c store_sample N/A N/A N/A open data_path rb read exemplar4.vmem mem N/A input_data N/A N/A c get_sample md5 N/A adapter N/A RekallAdapter N/A 
<<< Unit Test >>> N/A N/A N/A adapter set_plugin_name imageinfo N/A output N/A N/A adapter execute input_data N/A N/A N/A pprint pprint output N/A N/A N/A adapter set_plugin_name pslist N/A output N/A N/A adapter execute input_data N/A N/A N/A pprint pprint output N/A N/A N/A adapter set_plugin_name dlllist N/A output N/A N/A adapter execute input_data N/A N/A N/A pprint pprint output N/A N/A N/A __name__ __main__ N/A N/A N/A test