(self)
return dict(config={}, data=results)
Volatility gdt plugin.
        @see volatility/plugins/malware/idt.py
Volatility gdt plugin.
Volatility gdt plugin .
def gdt(self):
        """Volatility gdt plugin.
        @see volatility/plugins/malware/idt.py
        """
        results = []

        command = self.plugins["gdt"](self.config)
        # Comment: this code is pretty much ripped from
        # render_text in volatility.
        for n, entry in command.calculate():
            selector = n * 8

            # Is the entry present? This applies to all types of GDT entries
            if entry.Present:
                present = "P"
            else:
                present = "Np"

            # The base, limit, and granularity is calculated differently
            # for 32bit call gates than they are for all other types.
            if entry.Type == "CallGate32":
                base = entry.CallGate
                limit = 0
                granularity = "-"
            else:
                base = entry.Base
                limit = entry.Limit
                if entry.Granularity:
                    granularity = "Pg"
                else:
                    granularity = "By"

            # The parent is GDT. The grand-parent is _KPCR.
            cpu_number = entry.obj_parent.obj_parent.ProcessorBlock.Number

            results.append({
                "cpu_number": int(cpu_number),
                "selector": hex(selector),
                "base": hex(int(base)),
                "limit": hex(int(limit)),
                "type": str(entry.Type),
                "dpl": str(entry.Dpl),
                "granularity": granularity,
                "present": present,
            })

        return dict(config={}, data=results)
def gdt ( self ) : results = [ ] command = self . plugins [ "gdt" ] ( self . config ) # Comment: this code is pretty much ripped from # render_text in volatility. for n , entry in command . calculate ( ) : selector = n * 8 # Is the entry present? This applies to all types of GDT entries if entry . Present : present = "P" else : present = "Np" # The base, limit, and granularity is calculated differently # for 32bit call gates than they are for all other types. if entry . Type == "CallGate32" : base = entry . CallGate limit = 0 granularity = "-" else : base = entry . Base limit = entry . Limit if entry . Granularity : granularity = "Pg" else : granularity = "By" # The parent is GDT. The grand-parent is _KPCR. cpu_number = entry . obj_parent . obj_parent . ProcessorBlock . Number results . append ( { "cpu_number" : int ( cpu_number ) , "selector" : hex ( selector ) , "base" : hex ( int ( base ) ) , "limit" : hex ( int ( limit ) ) , "type" : str ( entry . Type ) , "dpl" : str ( entry . Dpl ) , "granularity" : granularity , "present" : present , } ) return dict ( config = { } , data = results )