Re: [Vol-dev] question on the code
3 Oct
2008
3 Oct
'08
6:07 p.m.
Jun,
I don't know about a trap, but it is something. By the way, you may want
to check out the examples in the memory_plugins directory. These plugins
all use the new object model which everything will be transitioning to in
the near future.
Thanks,
AW
On Sat, 4 Oct 2008, Jun Koi wrote:
On Fri, Oct 3, 2008 at 10:36 PM, AAron Walters
<awalters(a)4tphi.net> wrote:
Jun,
The types variable is instantiated from vtypes.py. This is the part of the
Profile used to describe the operating system's data types.
What a trap!
Thanks,
J
On Fri, 3 Oct 2008, Jun Koi wrote:
Hi,
I am trying to read the code, and found this in vmodules.py:
def get_connections(cmdname, argv):
"""
Function prints a list of open connections
"""
op = get_standard_parser(cmdname)
opts, args = op.parse_args(argv)
star_line = '*'*72
(addr_space, symtab, types) = load_and_identify_image(op, opts) # <--
Here
connections = tcb_connections(addr_space, types, symtab)
....
I dont understand what the "types" variable above means. Even track
back the source, I dont see how it is produced.
Anybody could explain a bit, so I can continue to dig? (sorry that my
Python skill is still very modest)
Thanks,
J
_______________________________________________
Vol-dev mailing list
Vol-dev(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev