Package winappdbg :: Module sql :: Class MemoryDTO

[frames] | no frames]

Class MemoryDTO

source code

Database mapping for memory dumps.

Instance Methods

[hide private]

__init__(self, crash_id, mbi)
Process a win32.MemoryBasicInformation object for database storage.

source code

_to_access(self, protect)

source code

win32.MemoryBasicInformation

toMBI(self, getMemoryDump=False)
Returns a win32.MemoryBasicInformation object using the data retrieved from the database.

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Static Methods

[hide private]

_parse_state(state)

source code

_parse_type(type)

source code

_parse_access(access)

source code

Class Variables

[hide private]

__tablename__ = 'memory'

id = Column(Integer, Sequence(__tablename__+ '_seq'), primary_...

crash_id = Column(Integer, ForeignKey('crashes.id', ondelete= ...

address = Column(BigInteger, nullable= False, index= True)

size = Column(BigInteger, nullable= False)

state = Column(MEM_STATE_ENUM, nullable= False)

access = Column(MEM_ACCESS_ENUM)

type = Column(MEM_TYPE_ENUM)

alloc_base = Column(BigInteger)

alloc_access = Column(MEM_ALLOC_ACCESS_ENUM)

filename = Column(String)

content = deferred(Column(LargeBinary))

__mapper__ = <Mapper at 0x3e51550; MemoryDTO>

__table__ = Table('memory', MetaData(bind=None), Column('id', ...

_sa_class_manager = <ClassManager of <class 'winappdbg.sql.Mem...

Inherited from BaseDTO: metadata

Inherited from BaseDTO (private): _decl_class_registry

Inherited from unreachable.BaseDTO: __table_args__

Properties

[hide private]

Inherited from object: __class__

Method Details

[hide private]

init(self, crash_id, mbi)
(Constructor)

source code

Process a win32.MemoryBasicInformation object for database storage.

Overrides: object.__init__

toMBI(self, getMemoryDump=False)

source code

Returns a win32.MemoryBasicInformation object using the data retrieved from the database.

Parameters:

getMemoryDump (bool) - (Optional) If True retrieve the memory dump. Defaults to False since this may be a costly operation.

Returns: win32.MemoryBasicInformation

Memory block information.

Class Variable Details

[hide private]

id

Value:

Column(Integer, Sequence(__tablename__+ '_seq'), primary_key= True, au
toincrement= True)

crash_id

Value:

Column(Integer, ForeignKey('crashes.id', ondelete= 'CASCADE', onupdate
= 'CASCADE'), nullable= False)

table

Value:

Table('memory', MetaData(bind=None), Column('id', Integer(), table=<me
mory>, primary_key=True, nullable=False, default=Sequence('memory_seq'
, metadata=MetaData(bind=None))), Column('crash_id', Integer(), Foreig
nKey('crashes.id'), table=<memory>, nullable=False), Column('address',
 BigInteger(), table=<memory>, nullable=False), Column('size', BigInte
ger(), table=<memory>, nullable=False), Column('state', Enum('Reserved
', 'Commited', 'Free', 'Unknown', name='MEM_STATE_ENUM'), table=<memor
y>, nullable=False), Column('access', Enum('--- GNW', '--- GN-', '--- 
...

_sa_class_manager

Value:

<ClassManager of <class 'winappdbg.sql.MemoryDTO'> at 3dee880>

Class MemoryDTO

__init__(self, crash_id, mbi) (Constructor)

toMBI(self, getMemoryDump=False)

id

crash_id

__table__

_sa_class_manager

init(self, crash_id, mbi)
(Constructor)

table