parameters: (self,
                         context: interfaces.context.ContextInterface,
                         vlayer: layers.intel.Intel,
                         pattern: bytes,
                         result_offset: int,
                         progress_callback: constants.ProgressCallback = None)
return_statement: return valid_kernel
docstring: Method for finding a suitable kernel offset based on a module
          table.
docstring_summary: Method for finding a suitable kernel offset based on a module
          table.
docstring_tokens: Method for finding a suitable kernel offset based on a module table .
function: def _method_offset(self,
                         context: interfaces.context.ContextInterface,
                         vlayer: layers.intel.Intel,
                         pattern: bytes,
                         result_offset: int,
                         progress_callback: constants.ProgressCallback = None) -> Optional[ValidKernelType]:
          """Method for finding a suitable kernel offset based on a module
          table."""
          vollog.debug("Kernel base determination - searching layer module list structure")
          valid_kernel = None  # type: Optional[ValidKernelType]
          # If we're here, chances are high we're in a Win10 x64 image with kernel base randomization
          physical_layer_name = self.get_physical_layer_name(context, vlayer)
          physical_layer = context.layers[physical_layer_name]
          # TODO:  On older windows, this might be \WINDOWS\system32\nt rather than \SystemRoot\system32\nt
          results = physical_layer.scan(context, scanners.BytesScanner(pattern), progress_callback = progress_callback)
          seen = set()  # type: Set[int]
          # Because this will launch a scan of the virtual layer, we want to be careful
          for result in results:
              # TODO: Identify the specific structure we're finding and document this a bit better
              pointer = context.object("pdbscan!unsigned long long",
                                       offset = (result + result_offset),
                                       layer_name = physical_layer_name)
              address = pointer & vlayer.address_mask
              if address in seen:
                  continue
              seen.add(address)
  
              valid_kernel = self.check_kernel_offset(context, vlayer, address, progress_callback)
  
              if valid_kernel:
                  break
          return valid_kernel
function_tokens: def _method_offset ( self , context : interfaces . context . ContextInterface , vlayer : layers . intel . Intel , pattern : bytes , result_offset : int , progress_callback : constants . ProgressCallback = None ) -> Optional [ ValidKernelType ] : vollog . debug ( "Kernel base determination - searching layer module list structure" ) valid_kernel = None # type: Optional[ValidKernelType] # If we're here, chances are high we're in a Win10 x64 image with kernel base randomization physical_layer_name = self . get_physical_layer_name ( context , vlayer ) physical_layer = context . layers [ physical_layer_name ] # TODO:  On older windows, this might be \WINDOWS\system32\nt rather than \SystemRoot\system32\nt results = physical_layer . scan ( context , scanners . BytesScanner ( pattern ) , progress_callback = progress_callback ) seen = set ( ) # type: Set[int] # Because this will launch a scan of the virtual layer, we want to be careful for result in results : # TODO: Identify the specific structure we're finding and document this a bit better pointer = context . object ( "pdbscan!unsigned long long" , offset = ( result + result_offset ) , layer_name = physical_layer_name ) address = pointer & vlayer . address_mask if address in seen : continue seen . add ( address ) valid_kernel = self . check_kernel_offset ( context , vlayer , address , progress_callback ) if valid_kernel : break return valid_kernel