ApcSelector

class ntoseye.ApcSelector

Subclass of BaseRecord.

The threads !apc inspects; kind says which.

property kind: Literal['current_thread', 'thread', 'process', 'number', 'all']

The variant: current_thread, thread, process, number, all.

final class All

Subclass of ApcSelector.

Enumerate every thread in the bounded process/thread walk.

property kind: Literal['all']

all.

final class CurrentThread

Subclass of ApcSelector.

Select the Windows thread currently selected by the session.

property kind: Literal['current_thread']

current_thread.

final class Number

Subclass of ApcSelector.

Resolve a numeric target as a thread first, then a PID/EPROCESS.

property kind: Literal['number']

number.

property number: int

final class Process

Subclass of ApcSelector.

Select all threads owned by a PID or EPROCESS value.

property kind: Literal['process']

process.

property process: int

final class Thread

Subclass of ApcSelector.

Select a thread by ETHREAD, KTHREAD, or TID value.

property kind: Literal['thread']

thread.

property thread: int