BlockMatch¶
- class ntoseye.BlockMatch¶
Subclass of
BaseRecord.Where a searched address lands inside a heap, told apart by
kind.- property kind: Literal['nt_entry', 'nt_lfh_block', 'nt_virtual', 'nt_segment', 'page', 'vs_chunk', 'lfh_block', 'range', 'large']¶
The variant:
nt_entry,nt_lfh_block,nt_virtual,nt_segment,page,vs_chunk,lfh_block,range,large.
- final class Direct¶
Subclass of
BlockMatch.A segment-heap range that the heap allocated directly from its segment.
- final class Large¶
Subclass of
BlockMatch.Inside a segment-heap large allocation.
- property allocation: LargeAllocation¶
- final class LfhBlock¶
Subclass of
BlockMatch.Inside block
indexof a segment-heap LFH subsegment.- property subsegment: LfhSubsegment¶
- final class NtEntry¶
Subclass of
BlockMatch.Inside an NT-heap entry.
- final class NtLfhBlock¶
Subclass of
BlockMatch.Inside a legacy-LFH block of an NT heap: block
indexof the user blockregionin the busyentry.- property region: NtUserBlocks¶
- final class NtSegmentOnly¶
Subclass of
BlockMatch.Inside a segment but not on the chain: the heap header, an uncommitted range, or past where the walk had to stop.
- property stopped: HeapWalkStop | None¶
Where the entry walk stopped, and why. None if the walk did not stop early.
- final class NtVirtual¶
Subclass of
BlockMatch.Inside an NT-heap virtually allocated block.
- property block: NtVirtualBlock¶
- final class RangeOnly¶
Subclass of
BlockMatch.Inside a page range but outside its subsegment’s blocks (header, bitmap, or trailing slack).