Package modules :: Package processing :: Module behavior :: Class Enhanced
[hide private]
[frames] | no frames]

Class Enhanced

source code

object --+
         |
        Enhanced

Generates a more extensive high-level representation than Summary.

Instance Methods [hide private]
 
__init__(self, details=False)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
_add_procedure(self, mbase, name, base)
Add a procedure address
source code
 
_add_loaded_module(self, name, base)
Add a loaded module to the internal database
source code
 
_get_loaded_module(self, base)
Get the name of a loaded module from the internal db
source code
 
_add_keyhandle(self, registry, subkey, handle) source code
 
_remove_keyhandle(self, handle) source code
 
_get_keyhandle(self, handle) source code
 
_process_call(self, call)
Gets files calls
source code
 
event_apicall(self, call, process)
Generate processes list from streamed calls/processes.
source code
 
run(self)
Get registry keys, mutexes and files.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  key = 'enhanced'
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, details=False)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Parameters:
  • details - Also add some (not so relevant) Details to the log
Overrides: object.__init__

_process_call(self, call)

source code 

Gets files calls

Returns:
information list

event_apicall(self, call, process)

source code 

Generate processes list from streamed calls/processes.

Returns:
None.

run(self)

source code 

Get registry keys, mutexes and files.

Returns:
Summary of keys, mutexes and files.