Re: [Vol-dev] question on the code
6 Oct
2008
6 Oct
'08
10:07 a.m.
What is the old object model? Can you give an example of how things have changed?
Will the scripts in vmodules be changing as well, or are they already using the
new model?
--
Jesse
jessek(a)speakeasy.net
On Fri Oct 3 18:07 , AAron Walters sent:
Jun,
I don't know about a trap, but it is something. By the way, you may want
to check out the examples in the memory_plugins directory. These plugins
all use the new object model which everything will be transitioning to in
the near future.
Thanks,
AW
On Sat, 4 Oct 2008, Jun Koi wrote:
On Fri, Oct 3, 2008 at 10:36 PM, AAron Walters
awalters(a)4tphi.net> wrote:
_______________________________________________
Vol-dev mailing list
Vol-dev(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev
Jun,
The types variable is instantiated from vtypes.py. This is the part of the
Profile used to describe the operating system's data types.
What a trap!
Thanks,
J
On Fri, 3 Oct 2008, Jun Koi wrote:
Hi,
I am trying to read the code, and found this in vmodules.py:
def get_connections(cmdname, argv):
"""
Function prints a list of open connections
"""
op = get_standard_parser(cmdname)
opts, args = op.parse_args(argv)
star_line = '*'*72
(addr_space, symtab, types) = load_and_identify_image(op, opts) #
Here
connections = tcb_connections(addr_space, types, symtab)
....
I dont understand what the "types" variable above means. Even track
back the source, I dont see how it is produced.
Anybody could explain a bit, so I can continue to dig? (sorry that my
Python skill is still very modest)
Thanks,
J
_______________________________________________
Vol-dev mailing list
Vol-dev(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev