Package modules :: Package processing :: Package platform :: Module windows :: Class RebootReconstructor
[hide private]
[frames] | no frames]

Class RebootReconstructor

source code

object --+
         |
        RebootReconstructor

Reconstructs the behavior as would be seen after a reboot.

Instance Methods [hide private]
 
process_apicall(self, event) source code
 
_api_delete_regkey(self, return_value, arguments, flags) source code
 
_api_RegDeleteKeyA(self, return_value, arguments, flags) source code
 
_api_RegDeleteKeyW(self, return_value, arguments, flags) source code
 
_api_RegDeleteValueA(self, return_value, arguments, flags) source code
 
_api_RegDeleteValueW(self, return_value, arguments, flags) source code
 
_api_NtDeleteValueKey(self, return_value, arguments, flags) source code
 
parse_cmdline(self, command_line)
Extract the filepath and arguments from the full commandline.
source code
 
_handle_run(self, arguments, flags)
Handle Run registry keys.
source code
 
_handle_runonce(self, arguments, flags)
For RunOnce there is no registry key persistence.
source code
 
_api_set_regkey(self, return_value, arguments, flags) source code
 
_api_RegSetValueExA(self, return_value, arguments, flags) source code
 
_api_RegSetValueExW(self, return_value, arguments, flags) source code
 
_api_NtSetValueKey(self, return_value, arguments, flags) source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __init__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  _reg_regexes = [(_handle_run, ".*\\\\Software\\\\(Wow6432Node\...
Properties [hide private]

Inherited from object: __class__

Class Variable Details [hide private]

_reg_regexes

Value:
[(_handle_run, ".*\\\\Software\\\\(Wow6432Node\\\\)?Microsoft\\\\Windo\
ws\\\\CurrentVersion\\\\Run"), (_handle_runonce, ".*\\\\Software\\\\(W\
ow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce"),]