Python API

The ntoseye package’s API, generated from the type stub the package ships. For how the pieces fit together, see the SDK guide.

Module ntoseye

ntoseye.__version__: Final[str]

The ntoseye release this extension was built as.

ntoseye.build: Final[str]

The git commit this extension was built from (<commit>, <commit>-dirty, or unknown), to detect a stale extension in a long-lived interpreter.

ntoseye.attach(backend: Literal['kd', 'kdnet', 'gdb', 'memory', 'dmp'] = ..., connect: str | None = None, key: str | None = None, memory_source: Literal['auto', 'host', 'kd'] = ...) → Debugger

Attach to a guest and return a Debugger.

backend is one of "kd" (default), "kdnet", "gdb", "memory", or "dmp". connect is the backend target: socket path / address for kd/kdnet/gdb, or the dump file path for dmp; the per-backend default is used when omitted (except dmp, which requires a path). key is required for kdnet. memory_source is auto, host, or kd for KD/KDNET.

kd/kdnet/gdb take a per-target instance lock before building the backend, so a second live attach against the same target fails fast rather than racing on the handshake the first session owns; memory/dmp are passive.

ntoseye.decode_error(code: int) → Record

Decode an NTSTATUS, Win32, or HRESULT code to its name and description (!error). Needs no target.

Module ntoseye.repl

REPL command scripting helpers for ntoseye.

Command scripts in ~/.ntoseye/commands/ import this module. Inside the REPL (the ntoseye command this package installs, or a build with embedded Python) register_command is the REPL’s own; anywhere else it raises, so a command script run outside the REPL fails clearly.

Debugger is re-exported from ntoseye; a command receives a borrowed ntoseye.Debugger.

ntoseye.repl.register_command(name: str, help: str, fn: Callable[..., Any], strategies: list[str] | None = None) → None

Register a REPL command called as fn(dbg, *raw_args); dbg is a borrowed Debugger, valid only until the command returns.

ntoseye.repl.command(name: str, help: str, **completions: _Completion) → Callable[[_F], _F]

Decorator form of register_command: keyword arguments bind completion markers to the command’s parameters by name. dbg (the first parameter) is a borrowed Debugger, valid only until the command returns.

ntoseye.repl.Process

Completion marker: binds a command parameter to process completion in command(..., param=Process).

ntoseye.repl.Symbol

Completion marker: binds a command parameter to symbol completion in command(..., param=Symbol).

ntoseye.repl.Expression

Completion marker: binds a command parameter to expression completion in command(..., param=Expression).

ntoseye.repl.Type

Completion marker: binds a command parameter to type completion in command(..., param=Type).

ntoseye.repl.Driver

Completion marker: binds a command parameter to driver completion in command(..., param=Driver).

ntoseye.repl.Thread

Completion marker: binds a command parameter to thread completion in command(..., param=Thread).

ntoseye.repl.Vcpu

Completion marker: binds a command parameter to vcpu completion in command(..., param=Vcpu).

ntoseye.repl.Breakpoint

Completion marker: binds a command parameter to breakpoint completion in command(..., param=Breakpoint).

ntoseye.repl.Alias

Completion marker: binds a command parameter to alias completion in command(..., param=Alias).

Classes