{"action":"opened","issue":{"url":"https://api.github.com/repos/google/rekall/issues/159","repository_url":"https://api.github.com/repos/google/rekall","labels_url":"https://api.github.com/repos/google/rekall/issues/159/labels{/name}","comments_url":"https://api.github.com/repos/google/rekall/issues/159/comments","events_url":"https://api.github.com/repos/google/rekall/issues/159/events","html_url":"https://github.com/google/rekall/issues/159","id":164031094,"number":159,"title":"Have to call __str__() on memdump plugin to make it work","user":{"login":"HJTP","id":2290383,"avatar_url":"https://avatars.githubusercontent.com/u/2290383?v=3","gravatar_id":"","url":"https://api.github.com/users/HJTP","html_url":"https://github.com/HJTP","followers_url":"https://api.github.com/users/HJTP/followers","following_url":"https://api.github.com/users/HJTP/following{/other_user}","gists_url":"https://api.github.com/users/HJTP/gists{/gist_id}","starred_url":"https://api.github.com/users/HJTP/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HJTP/subscriptions","organizations_url":"https://api.github.com/users/HJTP/orgs","repos_url":"https://api.github.com/users/HJTP/repos","events_url":"https://api.github.com/users/HJTP/events{/privacy}","received_events_url":"https://api.github.com/users/HJTP/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-07-06T09:07:49Z","updated_at":"2016-07-06T09:07:49Z","closed_at":null,"body":"Using Rekall from a Python script, I have to call __str__() on the memdump plugin to make it actually do something. So, given a session s on a Windows 10 x64 dump in ELF format, with profile specified:\r\n`for process in pslist:`\r\n&nbsp;&nbsp;&nbsp;&nbsp;`s.plugins.memdump(process['_EPROCESS'].pid)`\r\nDoes not do anything as far as I can tell, it does not call the memdump plugin functions from memmap.py. \r\n\r\nHowever, \r\n`for process in pslist:`\r\n&nbsp;&nbsp;&nbsp;&nbsp;`s.plugins.memdump(process['_EPROCESS'].pid).__str__()`\r\nDoes call the functions, and it starts the dumping. \r\n\r\nIs this intended behaviour? "}}
{"actor":{"display_login":"HJTP"}}