Module Expr Str Import alias identifier Import alias identifier Assign NameStore Str Assign NameStore Str Assign NameStore Num Assign NameStore Str Assign NameStore Str Assign NameStore Str ClassDef bases AttributeLoad NameLoad attr body Expr Str FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr keyword Str Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr Assert CompareEq Call NameLoad NameLoad Num Str Assign TupleStore NameStore NameStore SubscriptLoad NameLoad Index Num For NameStore Call NameLoad Num NameLoad NameLoad body Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad If BoolOpAnd CompareIn NameLoad NameLoad CompareIn NameLoad NameLoad body Assign NameStore ListLoad Assign NameStore NameLoad For NameStore Call AttributeLoad NameLoad attr body If BoolOpAnd CompareIn NameLoad NameLoad UnaryOpNot NameLoad body Assign NameStore NameLoad Expr Call AttributeLoad NameLoad attr NameLoad orelse If BoolOpAnd CompareIn NameLoad NameLoad NameLoad body Assign NameStore NameLoad Expr Call AttributeLoad NameLoad attr NameLoad orelse If NameLoad body Expr Call AttributeLoad NameLoad attr NameLoad If CompareNotEq Call NameLoad NameLoad Num body Expr Yield Call AttributeLoad Str attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Expr Str For NameStore NameLoad body Expr Call AttributeLoad NameLoad attr NameLoad decorator_list decorator_list
N/A N/A Volatility plugin to extract base64/PEM encoded private RSA keys from
physical memory.

 N/A volatility.plugins.common common N/A volatility.utils utils N/A START_MARKER -----BEGIN RSA PRIVATE KEY----- N/A END_MARKER -----END RSA PRIVATE KEY----- N/A CHUNK_SIZE 10240 N/A __author__ Philip Huppert N/A __copyright__ Copyright 2014, Philip Huppert N/A __license__ MIT RSAKey N/A N/A common AbstractWindowsCommand N/A N/A Extract base64/PEM encoded private RSA keys from physical memory. calculate N/A N/A self N/A N/A N/A Search for PEM encoded RSA keys. N/A mem N/A N/A utils load_as N/A self _config astype physical N/A addrs N/A list N/A N/A mem get_available_addresses N/A N/A N/A len addrs 1 Physical memory is fragmented N/A N/A mem_start mem_size N/A addrs N/A 0 N/A offset N/A xrange 0 mem_size CHUNK_SIZE N/A N/A chunk N/A N/A mem zread offset CHUNK_SIZE N/A N/A N/A START_MARKER chunk N/A END_MARKER chunk N/A N/A key N/A N/A in_key False N/A line N/A N/A chunk splitlines N/A N/A N/A N/A START_MARKER line N/A in_key N/A N/A in_key True N/A N/A N/A key append line N/A N/A N/A N/A END_MARKER line in_key N/A N/A in_key False N/A N/A N/A key append line N/A N/A in_key N/A N/A N/A N/A key append line N/A N/A N/A len key 0 N/A N/A N/A N/A N/A join key N/A render_text N/A N/A self outfd data N/A N/A N/A Display found keys. N/A key data N/A N/A N/A N/A outfd writeln key N/A N/A