Index

Symbols

!acl command !address command !analyze command !apc command !chkimg command !cpuinfo command !db command !dbgprint command !dd command !devnode command !devobj command !devstack command !dlls command !dpcs command !dq command !drvobj command !dw command !eb command !ed command !eq command !error command !fileobj command !gdt command !gle command !handle command !heap command !idt command !irp command !irql command !list command !locks command !lookaside command !memusage command !ntstatus command !object command !objsd command !pcr command !peb command !pfn command !pnptriage command !pool command !poolfind command !poolused command !prcb command !process command !pte command !ptov command !ready command !running command !sd command !session command

!sid command !sprocess command !stacks command !teb command !thread command !timer command !token command !trustlets command !vad command !verifier command !vm command !vtop command .cls command .context command .crash command .cxr command .dump command .echo command .ecxr command .effmach command .exr command .fetchimage command .formats command .frame command .help command .hh command .kdfiles command .lastevent command .logappend command .logclose command .logopen command .pagein command .printf command .process command .readmem command .reboot command .reload command .restart command .srcpath command .srcpath+ command .symfix command .sympath command .sympath+ command .thread command .time command .trap command .vtl command .vtlcxr command .writemem command ? command ~ command

_

__contains__() (ntoseye.Breakpoints method) (ntoseye.Drivers method) (ntoseye.Heaps method) (ntoseye.Modules method) (ntoseye.Processes method) (ntoseye.Record method) (ntoseye.Regions method) (ntoseye.Registers method) (ntoseye.Symbols method) (ntoseye.Threads method) (ntoseye.Types method) __enter__() (ntoseye.Debugger method) __exit__() (ntoseye.Debugger method) __getattr__() (ntoseye.Record method) (ntoseye.Registers method) (ntoseye.Struct method) __getitem__() (ntoseye.Breakpoints method) (ntoseye.Cpus method) (ntoseye.Drivers method) (ntoseye.Frame method) (ntoseye.Heaps method) (ntoseye.Module method) (ntoseye.Modules method) (ntoseye.Msrs method) (ntoseye.Processes method) (ntoseye.Record method) (ntoseye.Regions method) (ntoseye.Registers method) (ntoseye.Struct method) (ntoseye.Symbols method) (ntoseye.Threads method) (ntoseye.Types method) __iter__() (ntoseye.BreakpointIterator method) (ntoseye.Breakpoints method) (ntoseye.CpuIterator method) (ntoseye.Cpus method) (ntoseye.DriverIterator method) (ntoseye.Drivers method) (ntoseye.Exceptions method) (ntoseye.HeapIterator method) (ntoseye.Heaps method) (ntoseye.MemoryRegionIterator method) (ntoseye.ModuleIterator method) (ntoseye.Modules method) (ntoseye.NameIterator method) (ntoseye.Processes method) (ntoseye.ProcessIterator method) (ntoseye.Record method) (ntoseye.RecordIterator method) (ntoseye.Regions method) (ntoseye.Registers method) (ntoseye.ThreadIterator method) (ntoseye.Threads method)

__len__() (ntoseye.Breakpoints method) (ntoseye.Cpus method) (ntoseye.Drivers method) (ntoseye.Exceptions method) (ntoseye.Heaps method) (ntoseye.Modules method) (ntoseye.Processes method) (ntoseye.Record method) (ntoseye.Regions method) (ntoseye.Registers method) (ntoseye.Threads method) __setattr__() (ntoseye.Registers method) (ntoseye.Struct method) __setitem__() (ntoseye.Msrs method) (ntoseye.Registers method) (ntoseye.Struct method) __version__ (in module ntoseye)

A

access (ntoseye.Watchpoint property) acl command acl() (ntoseye.Inspect method) action (ntoseye.Breakpoint property) ad command add() (ntoseye.Breakpoints method) add_pattern() (ntoseye.Breakpoints method) add_source() (ntoseye.Breakpoints method) addr (ntoseye.Struct property) address command address (ntoseye.Breakpoint property) (ntoseye.Device property) (ntoseye.Export property) (ntoseye.Heap property) (ntoseye.MemorySearchMatch property) (ntoseye.Stop.Exception property) (ntoseye.Symbol property) (ntoseye.Trustlet property) address_of() (ntoseye.Struct method) AddressModule (class in ntoseye) al command

alias command Alias (in module ntoseye.repl) aliases command analyze command apc command apcs() (ntoseye.Inspect method) (ntoseye.Process method) (ntoseye.Thread method) as command at() (ntoseye.Drivers method) (ntoseye.Modules method) (ntoseye.Regions method) (ntoseye.Threads method) (ntoseye.Type method) attach command attach() (in module ntoseye) available (ntoseye.Diagnostic property)

B

ba command backtrace() (ntoseye.Thread method) base (ntoseye.AddressModule property) (ntoseye.Module property) (ntoseye.SecureKernel property) bc command bd command be command bl command bm command bp command bpa command

bpc command bpp command br command break command Breakpoint (class in ntoseye) (in module ntoseye.repl) BreakpointIterator (class in ntoseye) Breakpoints (class in ntoseye) breakpoints (ntoseye.Debugger property) (ntoseye.Stop property) bs command bu command bugcheck() (ntoseye.Inspect method) build (in module ntoseye)

C

callbacks command callbacks() (ntoseye.Inspect method) candidates() (ntoseye.Symbols method) capabilities command capabilities (ntoseye.Debugger property) cast() (ntoseye.Struct method) check_image() (ntoseye.Module method) chkimg command close() (ntoseye.Debugger method) code (ntoseye.Stop.Exception property) coherent (ntoseye.Debugger property) (ntoseye.Stop.Reboot property) command !acl !address !analyze !apc !chkimg !cpuinfo !db !dbgprint !dd !devnode !devobj !devstack !dlls !dpcs !dq !drvobj !dw !eb !ed !eq !error !fileobj !gdt !gle !handle !heap !idt !irp !irql !list !locks !lookaside !memusage !ntstatus !object !objsd !pcr !peb !pfn !pnptriage !pool !poolfind !poolused !prcb !process !pte !ptov !ready !running !sd !session !sid !sprocess !stacks !teb !thread !timer !token !trustlets !vad !verifier !vm !vtop .cls .context .crash .cxr .dump .echo .ecxr .effmach .exr .fetchimage .formats .frame .help .hh .kdfiles .lastevent .logappend .logclose .logopen .pagein .printf .process .readmem .reboot .reload .restart .srcpath .srcpath+ .symfix .sympath .sympath+ .thread .time .trap .vtl .vtlcxr .writemem ? ~ acl ad address al alias aliases analyze apc as attach ba bc bd be bl bm bp bpa bpc bpp br break bs bu callbacks capabilities chkimg continue cpuinfo crash da db dbgprint dc dd dds detach devnode devobj devstack disasm dl dlls dp dpcs dpp dps dq dqs drivers drvobj dS ds dt du dump dv dW dw dyb ea eb echo ed eq eu ev ew eza ezu f finish frame g gdt gh gle gn gu heap help idt irp irps irql k kb kn kp kv ld lm lmv ln lookaside ls lsa n ni object objsd p pa pc pcr peb pfn ph pnptriage pool poolfind poolused prcb ps pt pte ptov q quit r rdmsr ready reboot registers reload-scripts restart running s sd session set si sid sprocess ssdt stacks status sx sxd sxe sxi sxl sxn sxr t ta tc teb th thread threads timer trap tt u ub uf unalias unset vars vcpu vcpus verifier version vertarget vm vmmap vtop wrmsr wt x

command() (in module ntoseye.repl) (ntoseye.Debugger method) commit_charge (ntoseye.MemoryRegion property) condition (ntoseye.Breakpoint property) condition_error (ntoseye.Stop.Breakpoint property) cont() (ntoseye.Debugger method) context_record() (ntoseye.Inspect method) continue command Cpu (class in ntoseye) cpu (ntoseye.Stop property) (ntoseye.Thread property) cpuinfo command CpuIterator (class in ntoseye) Cpus (class in ntoseye) cpus (ntoseye.Debugger property) crash command crash() (ntoseye.Debugger method)

D

da command db command dbgprint command dc command dd command dds command debug_log() (ntoseye.Debugger method) Debugger (class in ntoseye) decode_error() (in module ntoseye) delete() (ntoseye.Breakpoint method) describe() (ntoseye.Memory method) detach command details (ntoseye.MemoryRegion property) Device (class in ntoseye) device() (ntoseye.Inspect method) device_stack() (ntoseye.Inspect method) devices (ntoseye.Driver property) devnode command devnode() (ntoseye.Inspect method) devobj command devstack command Diagnostic (class in ntoseye) disasm command disassemble() (ntoseye.Memory method) disassemble_back() (ntoseye.Memory method) disassemble_function() (ntoseye.Memory method) dl command dlls command dp command

dpcs command dpcs() (ntoseye.Inspect method) dpp command dps command dq command dqs command Driver (class in ntoseye) (in module ntoseye.repl) DriverIterator (class in ntoseye) drivers command Drivers (class in ntoseye) drivers (ntoseye.Debugger property) drvobj command dS command ds command dt command dtb (ntoseye.Memory property) (ntoseye.Process property) (ntoseye.SecureKernel property) (ntoseye.Trustlet property) du command dump command dv command dW command dw command dyb command

E

ea command eb command echo command ed command enabled (ntoseye.Breakpoint property) end (ntoseye.MemoryRegion property) eprocess (ntoseye.Process property) eq command error (ntoseye.Diagnostic property) ethread (ntoseye.Thread property) eu command

ev command eval() (ntoseye.Debugger method) (ntoseye.Process method) (ntoseye.SecureKernel method) (ntoseye.Trustlet method) ew command exception_record() (ntoseye.Inspect method) Exceptions (class in ntoseye) exceptions (ntoseye.Debugger property) Export (class in ntoseye) exports (ntoseye.Module property) Expression (in module ntoseye.repl) eza command ezu command

F

f command fetch_image() (ntoseye.Module method) Field (class in ntoseye) fields (ntoseye.Type property) file_object() (ntoseye.Inspect method) file_version (ntoseye.Module property) find() (ntoseye.Processes method)

find_block() (ntoseye.Heaps method) finish command first_chance (ntoseye.Stop.Exception property) follow() (ntoseye.Struct method) forwarder (ntoseye.Export property) frame command Frame (class in ntoseye)

G

g command gdt command gdt() (ntoseye.Cpu method) generation (ntoseye.Debugger property) get() (ntoseye.Breakpoints method) (ntoseye.Cpus method) (ntoseye.Drivers method) (ntoseye.Heaps method) (ntoseye.Modules method) (ntoseye.Processes method) (ntoseye.Record method) (ntoseye.Symbols method) (ntoseye.Threads method) (ntoseye.Types method)

gh command gle command gn command gu command

H

handle() (ntoseye.Process method) handles() (ntoseye.Process method) heap command Heap (class in ntoseye)

HeapIterator (class in ntoseye) Heaps (class in ntoseye) heaps (ntoseye.Process property) help command hit_count (ntoseye.Breakpoint property)

I

id (ntoseye.Breakpoint property) (ntoseye.Cpu property) idt command idt() (ntoseye.Cpu method) image() (ntoseye.Module method) index (ntoseye.Frame property) (ntoseye.Heap property) info (ntoseye.Stop.Bugcheck property) info() (ntoseye.Cpu method) Inspect (class in ntoseye) inspect (ntoseye.Debugger property) inspect() (ntoseye.Device method) (ntoseye.Driver method) (ntoseye.Heap method) (ntoseye.Module method) (ntoseye.Thread method)

interrupt() (ntoseye.Debugger method) ip (ntoseye.Frame property) irp command irp() (ntoseye.Inspect method) irps command irps() (ntoseye.Inspect method) irql command irql() (ntoseye.Cpu method) items() (ntoseye.Record method) (ntoseye.Registers method)

K

k command kb command kernel_base (ntoseye.Stop.Reboot property) keys() (ntoseye.Record method) (ntoseye.Registers method)

kind (ntoseye.MemorySearchMatch property) kn command kp command kthread (ntoseye.Thread property) kv command

L

last_error() (ntoseye.Thread method) ld command length (ntoseye.Watchpoint property) lm command lmv command ln command

locals (ntoseye.Frame property) locals_at() (ntoseye.Symbols method) lookaside command lookaside() (ntoseye.Inspect method) lookasides() (ntoseye.Inspect method) ls command lsa command

M

Memory (class in ntoseye) memory (ntoseye.Debugger property) (ntoseye.Process property) (ntoseye.SecureKernel property) (ntoseye.Trustlet property) MemoryRegion (class in ntoseye) MemoryRegionIterator (class in ntoseye) MemorySearchMatch (class in ntoseye) memusage() (ntoseye.Inspect method) module ntoseye ntoseye.repl

Module (class in ntoseye) module (ntoseye.MemorySearchMatch property) (ntoseye.Symbol property) ModuleIterator (class in ntoseye) Modules (class in ntoseye) modules (ntoseye.Debugger property) (ntoseye.Process property) (ntoseye.SecureKernel property) msr (ntoseye.Cpu property) Msrs (class in ntoseye)

N

n command name (ntoseye.AddressModule property) (ntoseye.Driver property) (ntoseye.Export property) (ntoseye.Field property) (ntoseye.Module property) (ntoseye.Process property) (ntoseye.Section property) (ntoseye.Symbol property) (ntoseye.Trustlet property) (ntoseye.Type property)

NameIterator (class in ntoseye) nearest() (ntoseye.Symbols method) ni command notices() (ntoseye.Debugger method) ntoseye module ntoseye.repl module

O

object command object (ntoseye.Driver property) (ntoseye.Process property) (ntoseye.Thread property) object() (ntoseye.Inspect method) object_security() (ntoseye.Inspect method)

objsd command offset (ntoseye.AddressModule property) (ntoseye.Field property) (ntoseye.MemorySearchMatch property) (ntoseye.Symbol property) one_shot (ntoseye.Breakpoint property) ordinal (ntoseye.Export property)

P

p command pa command page_in() (ntoseye.Memory method) pass_count (ntoseye.Breakpoint property) path (ntoseye.Module property) (ntoseye.Symbols property) pc command pcr command pcr() (ntoseye.Cpu method) peb command peb (ntoseye.Process property) peb() (ntoseye.Inspect method) permissions (ntoseye.Section property) pfn command pfn() (ntoseye.Inspect method) ph command physical (ntoseye.Debugger property) pid (ntoseye.Process property) (ntoseye.Thread property) (ntoseye.Trustlet property) pnp_triage() (ntoseye.Inspect method) pnptriage command pointer_size (ntoseye.Memory property) pool command

pool() (ntoseye.Inspect method) pool_find() (ntoseye.Inspect method) pool_usage() (ntoseye.Inspect method) poolfind command poolused command ppid (ntoseye.Process property) prcb command prcb() (ntoseye.Cpu method) private_memory (ntoseye.MemoryRegion property) Process (class in ntoseye) (in module ntoseye.repl) process (ntoseye.Breakpoint property) (ntoseye.Cpu property) (ntoseye.Stop property) (ntoseye.Thread property) (ntoseye.Trustlet property) Processes (class in ntoseye) processes (ntoseye.Debugger property) ProcessIterator (class in ntoseye) processor (ntoseye.Breakpoint property) product_version (ntoseye.Module property) protection (ntoseye.MemoryRegion property) ps command pt command pte command ptov command ptov() (ntoseye.Memory method)

Q

q command

quit command

R

r command rdmsr command read() (ntoseye.Memory method) (ntoseye.Struct method) read_ansi_string() (ntoseye.Memory method) read_pointer() (ntoseye.Memory method) read_string() (ntoseye.Memory method) read_u16() (ntoseye.Memory method) read_u32() (ntoseye.Memory method) read_u64() (ntoseye.Memory method) read_u8() (ntoseye.Memory method) read_unicode_string() (ntoseye.Memory method) read_wstring() (ntoseye.Memory method) ready command ready() (ntoseye.Inspect method) reboot command reboot() (ntoseye.Debugger method) Record (class in ntoseye) record() (ntoseye.Stop method) RecordIterator (class in ntoseye) region (ntoseye.MemorySearchMatch property) Regions (class in ntoseye) regions (ntoseye.Process property)

register_command() (in module ntoseye.repl) registers command Registers (class in ntoseye) registers (ntoseye.Cpu property) (ntoseye.Frame property) reload() (ntoseye.Debugger method) (ntoseye.Symbols method) reload-scripts command reload_symbols() (ntoseye.Module method) remaining_pass_count (ntoseye.Breakpoint property) reset() (ntoseye.Exceptions method) reset_path() (ntoseye.Symbols method) resolved (ntoseye.Breakpoint property) resource() (ntoseye.Inspect method) resources() (ntoseye.Inspect method) restart command rip (ntoseye.Cpu property) (ntoseye.Stop property) run() (ntoseye.Debugger method) run_to() (ntoseye.Debugger method) running command running() (ntoseye.Inspect method) rva (ntoseye.Section property)

S

s command saved_vtl (ntoseye.Cpu property) sd command search() (ntoseye.Memory method) (ntoseye.Symbols method) Section (class in ntoseye) section (ntoseye.MemorySearchMatch property) sections (ntoseye.Module property) secure_kernel (ntoseye.Debugger property) SecureKernel (class in ntoseye) security_descriptor() (ntoseye.Inspect method) session command session (ntoseye.Process property) sessions() (ntoseye.Inspect method) set command set() (ntoseye.Exceptions method) si command sid command sid() (ntoseye.Inspect method) size (ntoseye.AddressModule property) (ntoseye.Driver property) (ntoseye.Field property) (ntoseye.Module property) (ntoseye.Section property) (ntoseye.Type property) source (ntoseye.Diagnostic property) (ntoseye.Frame property) source_addresses() (ntoseye.Symbols method) source_location() (ntoseye.Symbols method) source_path (ntoseye.Symbols property) sp (ntoseye.Frame property) specification (ntoseye.Breakpoint property) sprocess command ssdt command ssdt() (ntoseye.Inspect method) stacks command

stacks() (ntoseye.Inspect method) start (ntoseye.Driver property) (ntoseye.MemoryRegion property) state (ntoseye.Thread property) status command step() (ntoseye.Debugger method) step_out() (ntoseye.Debugger method) step_over() (ntoseye.Debugger method) Stop (class in ntoseye) stop (ntoseye.Debugger property) Stop.Breakpoint (class in ntoseye) Stop.Bugcheck (class in ntoseye) Stop.Exception (class in ntoseye) Stop.Interrupt (class in ntoseye) Stop.Reboot (class in ntoseye) Stop.Step (class in ntoseye) Struct (class in ntoseye) sx command sxd command sxe command sxi command sxl command sxn command sxr command Symbol (class in ntoseye) (in module ntoseye.repl) symbol (ntoseye.Breakpoint property) (ntoseye.Cpu property) (ntoseye.Frame property) (ntoseye.MemorySearchMatch property) (ntoseye.Stop property) Symbols (class in ntoseye) symbols (ntoseye.Debugger property) (ntoseye.Module property) (ntoseye.Process property) (ntoseye.SecureKernel property) (ntoseye.Trustlet property)

T

t command ta command tc command teb command teb (ntoseye.Thread property) teb() (ntoseye.Inspect method) temporary (ntoseye.Breakpoint property) termination (ntoseye.Modules property) th command thread command Thread (class in ntoseye) (in module ntoseye.repl) thread (ntoseye.Breakpoint property) (ntoseye.Cpu property) (ntoseye.Frame property) (ntoseye.Stop property) ThreadIterator (class in ntoseye) threads command Threads (class in ntoseye) threads (ntoseye.Debugger property) (ntoseye.Process property) tid (ntoseye.Thread property) time() (ntoseye.Inspect method) timer command timer() (ntoseye.Inspect method) timers() (ntoseye.Inspect method) timestamp (ntoseye.Module property) to_dict() (ntoseye.AddressModule method) (ntoseye.Breakpoint method) (ntoseye.Cpu method) (ntoseye.Device method) (ntoseye.Diagnostic method) (ntoseye.Driver method) (ntoseye.Export method) (ntoseye.Field method) (ntoseye.Frame method) (ntoseye.Heap method) (ntoseye.MemoryRegion method) (ntoseye.MemorySearchMatch method) (ntoseye.Module method) (ntoseye.Process method) (ntoseye.Record method) (ntoseye.Registers method) (ntoseye.Section method) (ntoseye.Stop method) (ntoseye.Struct method) (ntoseye.Symbol method) (ntoseye.Thread method) (ntoseye.Trustlet method) (ntoseye.Type method)

token() (ntoseye.Process method) trace_calls() (ntoseye.Debugger method) translate() (ntoseye.Memory method) translation() (ntoseye.Memory method) trap command trap_frame() (ntoseye.Inspect method) (ntoseye.Thread method) triage() (ntoseye.Inspect method) Trustlet (class in ntoseye) trustlet_id (ntoseye.Trustlet property) trustlets (ntoseye.SecureKernel property) tt command Type (class in ntoseye) (in module ntoseye.repl) type (ntoseye.Field property) (ntoseye.Struct property) Types (class in ntoseye) types (ntoseye.Debugger property) (ntoseye.Process property) (ntoseye.SecureKernel property) (ntoseye.Trustlet property)

U

u command ub command uf command

unalias command unset command

V

va_type (ntoseye.MemorySearchMatch property) vad_type (ntoseye.MemoryRegion property) valid (ntoseye.Breakpoint property) value (ntoseye.Diagnostic property) values (ntoseye.Type property) values() (ntoseye.Record method) vars command vcpu command Vcpu (in module ntoseye.repl) vcpus command verifier command

verifier() (ntoseye.Inspect method) (ntoseye.Module method) version command version() (ntoseye.Inspect method) vertarget command vm command vm() (ntoseye.Inspect method) vmmap command vtop command

W

wait() (ntoseye.Debugger method) wait_reason (ntoseye.Thread property) walk() (ntoseye.Struct method) (ntoseye.Type method) watch() (ntoseye.Breakpoints method) Watchpoint (class in ntoseye) wow64 (ntoseye.Process property) write() (ntoseye.Memory method)

write_dump() (ntoseye.Debugger method) write_u16() (ntoseye.Memory method) write_u32() (ntoseye.Memory method) write_u64() (ntoseye.Memory method) write_u8() (ntoseye.Memory method) wrmsr command wt command

X

x command