modules.processing.platform.windows.RebootReconstructor

Package modules :: Package processing :: Package platform :: Module windows :: Class RebootReconstructor |
[hide private]
[frames] | no frames]

# Class RebootReconstructor

source code

    object --+
             |
            RebootReconstructor

Reconstructs the behavior as would be seen after a reboot.

Instance Methods | [hide private]
process_apicall(self, event) | source code
_api_delete_regkey(self, return_value, arguments, flags) | source code
_api_RegDeleteKeyA(self, return_value, arguments, flags) | source code
_api_RegDeleteKeyW(self, return_value, arguments, flags) | source code
_api_RegDeleteValueA(self, return_value, arguments, flags) | source code
_api_RegDeleteValueW(self, return_value, arguments, flags) | source code
_api_NtDeleteValueKey(self, return_value, arguments, flags) | source code
parse_cmdline(self, command_line) Extract the filepath and arguments from the full commandline. | source code
_handle_run(self, arguments, flags) Handle Run registry keys. | source code
_handle_runonce(self, arguments, flags) For RunOnce there is no registry key persistence. | source code
_api_set_regkey(self, return_value, arguments, flags) | source code
_api_RegSetValueExA(self, return_value, arguments, flags) | source code
_api_RegSetValueExW(self, return_value, arguments, flags) | source code
_api_NtSetValueKey(self, return_value, arguments, flags) | source code
Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__init__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Class Variables | [hide private]
| _reg_regexes = `[(_handle_run, ".*\\\\Software\\\\(Wow6432Node\`...``

Properties | [hide private]
Inherited from `object`: `__class__`

Class Variable Details | [hide private]

  ### _reg_regexes Value:
      [(_handle_run, ".*\\\\Software\\\\(Wow6432Node\\\\)?Microsoft\\\\Windo
      ws\\\\CurrentVersion\\\\Run"), (_handle_runonce, ".*\\\\Software\\\\(W
      ow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce"),]