/usr/lib/python2.7/dist-packages/rekall/plugins/windows/registry/__init__.py is in python-rekall-core 1.6.0+dfsg-2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | # Module for memory analysis of the windows registry.
# pylint: disable=unused-import
from rekall.plugins.windows.registry import evtlogs
from rekall.plugins.windows.registry import getsids
from rekall.plugins.windows.registry import getservicesids
# Disabled currently since it only works on XP and it also appears to be broken.
#try:
# This optional plugin requires pycrypto
# from rekall.plugins.windows.registry import lsadump
#except ImportError:
# pass
from rekall.plugins.windows.registry import printkey
from rekall.plugins.windows.registry import registry
from rekall.plugins.windows.registry import userassist
|