Cpu

final class ntoseye.Cpu

One processor, identified by its backend vCPU id (such as "p1.1").

gdt() → Record

Decode this processor’s GDT (!gdt).

property id: str

The backend vCPU id.

idt(vector: int | None = None) → Record

Decode one IDT vector, or the bounded full table (!idt).

info() → Record

Read processor vendor, family, model, speed, and feature bits (!cpuinfo).

irql() → Record

Read this processor’s current IRQL (!irql).

property msr: Msrs

Model-specific registers: cpu.msr[0xC0000082], cpu.msr["IA32_LSTAR"].

pcr() → Record

Decode this processor’s KPCR and KPRCB essentials (!pcr).

prcb() → Record

Decode this processor’s _KPRCB (!prcb).

property process: Process | None

The process whose page tables are loaded on this processor.

property registers: Registers

This processor’s live register file (writable while halted in NT; read-only at a recognized VTL1 stop).

property rip: int | None

The instruction pointer (needs a halted target).

property saved_vtl: list[str]

For a vCPU halted in the Windows hypervisor (VBS), where its VTLs left off, from the hypervisor’s saved state: ["VTL0 nt!HalProcessorIdle+0xf"], plus VTL1 when the hypervisor was entered from it or is about to enter it. Needs the VM’s hv-evmcs; empty otherwise, or when the saved state fails validation.

property symbol: str | None

The symbol at rip, if one resolved.

property thread: Thread | None

The Windows thread running on this processor.

to_dict() → dict[str, Any]

The processor as a plain dict, the shape MCP renders.