def go_rekall(session, override_timestamp=None): from pypykatz.commons.readers.rekall.rekallreader import RekallReader reader = RekallReader.from_session(session, override_timestamp) sysinfo = KatzSystemInfo.from_rekallreader(reader) mimi = pypykatz(reader, sysinfo) mimi.start() return mimi
def parse_memory_dump_rekall(filename, override_timestamp=None): from pypykatz.commons.readers.rekall.rekallreader import RekallReader reader = RekallReader.from_memory_file(filename, override_timestamp) sysinfo = KatzSystemInfo.from_rekallreader(reader) mimi = pypykatz(reader, sysinfo) mimi.start() return mimi
def go_rekall(session, override_timestamp = None, buildnumber = None, packages = ['all']): from pypykatz.commons.readers.rekall.rekallreader import RekallReader reader = RekallReader.from_session(session, override_timestamp, buildnumber) sysinfo = KatzSystemInfo.from_rekallreader(reader) mimi = pypykatz(reader, sysinfo) mimi.start(packages) return mimi