Cpu

final class ntoseye.Cpu

One processor, identified by its number.

apic() → LocalApic

Show a processor’s local APIC: its ID, priorities, LVT, timer, and pending vectors.

Reads the local APIC of the selected processor, or of the processor you give: in x2APIC mode through its MSRs (0x800-0x83f), in xAPIC mode through its registers at the physical address IA32_APIC_BASE names, read uncached. Both need a backend that reads MSRs and device registers: kd or kdnet. The target reads them on the processor that stopped it, so for another processor ntoseye switches the target to it and back, as rdmsr /p does. Shows the APIC ID and version, whether it is the bootstrap processor, the task and processor priorities, the spurious-interrupt vector register, the logical destination, the interrupt command register as an IPI (vector, delivery mode, destination), each local vector table entry (timer, LINT0, LINT1, error, performance counter, thermal, CMCI) with its vector, delivery mode, trigger, and mask, the timer’s counts and divisor, the error status, and the vectors in service (ISR), requested (IRR), and level-triggered (TMR).

backtrace(*, limit: int = 64, vtl: int | None = None) → list[Frame]

Walk this processor’s stack from its own registers, whatever .thread, .cxr or .frame selected. Halted in the Windows hypervisor, the frames are the hypervisor’s (hv+...), as .cxr then k shows them; elsewhere they are the code it runs. With vtl, the walk starts where that VTL left off, as the hypervisor saved it (.vtlcxr): NT’s stack for 0, the secure kernel’s for 1. A vtl needs the processor halted in the hypervisor. Frames outside NT’s address spaces have no locals. thread.backtrace() walks a Windows thread instead, from where NT left off when its processor is in the hypervisor.

property context: str

What the vCPU runs: kernel, a process name, hypervisor, VTL1, a guest partition’s VP (partition 0x3 VP 1), or unknown; no context for a dump CPU whose context the dump lacks. Empty if ntoseye cannot read the register context.

cpuinfo() → CpuInfo

Show processor identification, speed, and feature bits.

Shows the processor number, vendor, family, model, stepping, speed, and feature bits if they are available. For a field that is not available, ntoseye uses the triage-dump metadata.

property error: str | None

The reason that the register context is not available. None if it is available.

gdt() → Gdt

Decode the bounded GDT of the current processor.

Shows the bounded GDT entries of the selected processor, with the base, limit, privilege, mode, and presence of each entry.

hypercall_caller() → HypercallCaller | None

The virtual processor whose hypercall this processor handles, for a vCPU halted in the Windows hypervisor, as !hvcall finds it: the guest partition’s VP that it serves, else the root partition’s VP on this processor. A when= callback of breakpoints.add_hypercall() reads the caller’s registers and memory through it (dbg.cpus[stop.cpu].hypercall_caller()), as the breakpoint’s condition does. None when the vCPU is not halted in the hypervisor, or the caller is unknown: the partitions cannot be walked, or no saved state of a VP that the processor runs is current.

idt(vector: int | None = None) → Idt

Decode one IDT entry or the bounded 256-entry IDT.

Shows one IDT vector or all 256 entries, with the handler, selector, gate type, DPL, presence, and non-nt hooks of each entry. Under a vector that dispatches through KiIsrThunk, the KINTERRUPT the processor has connected to it and its service routine.

property info: VcpuInfo

The VcpuInfo record of this handle: its properties as one value.

irql() → Irql

Show the current IRQL of a processor.

Shows the current IRQL and the Windows level name of the selected processor. At a KD break-in, this is the IRQL that the debugger sees, which can be different from the level before the break-in.

property memory: Memory

Memory through the page tables that this processor has loaded (its CR3) at the time of the read. These are the kernel’s or a process’s tables, a VTL1 root (read-only), or a root outside NT (read-only), such as the hypervisor’s root on a vCPU halted in the Windows hypervisor.

property msr: Msrs

Model-specific registers: cpu.msr[0xC0000082], cpu.msr["IA32_LSTAR"].

property number: int

The zero-based processor number: this processor is dbg.cpus[number].

pcr() → Pcr

Show the main KPCR data of the selected processor.

Shows the KPCR and KPRCB addresses, the thread pointers, the descriptor registers, the TSS, and the available IRQL fields. On AMD64 Windows, kernel GS usually points to the KPCR, and backend GS-base registers are optional.

prcb() → Prcb

Show the main KPRCB data of the selected processor.

Shows the processor number, the thread pointers, the DPC and interrupt counters, and the available ProcessorState metadata of the selected KPRCB.

property process: Process | None

The process whose page tables are loaded on this processor.

property registers: Registers

The live register file of this processor. It is writable while the processor is halted in NT, and read-only at a recognized VTL1 stop.

property rip: int | None

None if ntoseye cannot read the register context.

property saved_vtl: list[SavedVtl]

For a vCPU halted in the Windows hypervisor, the VTL states that the hypervisor saved for the vCPU’s virtual processor, VTL0 first.

property serving: ServedVp | None

For a vCPU halted in the Windows hypervisor, the guest partition’s virtual processor whose exit it handles or that it is about to enter, when it is not one of the root partition’s.

property symbol: str | None

The nearest symbol to rip, if one resolves.

property thread: Thread | None

The Windows thread that runs on this processor.

to_dict() → dict[str, Any]

The record (info) as a plain dict.