Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
ntoseye
Logo
ntoseye

Getting started

  • Install
  • Quickstart
  • Your first session
  • Coming from WinDbg
  • Troubleshooting
  • Command line

Setting up a target

  • Choosing a backend
  • KVM/QEMU
  • VMware Workstation
  • UTM (macOS, Apple Silicon)
  • KDNET

Using ntoseye

  • Using the REPL
  • Breakpoints and watchpoints
  • Memory and paging
  • Symbols and source
  • Bugchecks
  • Crash dumps
  • Driver replacement map (.kdfiles)
  • KMDF drivers (!wdfkd)
  • Developing drivers from a Linux host

Platform topics

  • WOW64 processes

VBS and the Windows hypervisor

  • Overview
  • Debugging a Windows Sandbox
  • The secure kernel (VTL1)
  • Partitions and virtual processors
  • Guest partitions
  • Hypercalls and VM exits
  • Stops in the Windows hypervisor
  • VBS internals

Integrations

  • Editor integration (DAP)
  • Disassembler integration (GDB remote protocol)
  • MCP integration

Scripting

  • Python SDK
  • Custom REPL commands
  • Python API
    • BaseRecord
    • Breakpoint
    • BreakpointIterator
    • Breakpoints
    • Cpu
    • CpuIterator
    • Cpus
    • Debugger
    • Device
    • Diagnostic
    • Driver
    • DriverIterator
    • Drivers
    • ExceptionPolicyIterator
    • Exceptions
    • Frame
    • Heap
    • HeapIterator
    • Heaps
    • HypercallCaller
    • HypervisorPartition
    • HypervisorVtl
    • Inspect
    • Memory
    • MemoryAccessError
    • MemoryRegionIterator
    • Module
    • ModuleIterator
    • Modules
    • Msrs
    • NameIterator
    • NtoseyeError
    • Process
    • Processes
    • ProcessIterator
    • Record
    • Regions
    • Registers
    • SecureKernel
    • StaleHandleError
    • Stop
    • Struct
    • SymbolNotFoundError
    • Symbols
    • TargetRunningError
    • Thread
    • ThreadIterator
    • Threads
    • Trustlet
    • Type
    • Types
    • VirtualProcessor
    • Watchpoint
    • Ace
    • Acl
    • AddressDescription
    • AddressModule
    • AddressTranslation
    • AlpcClientPort
    • AlpcConnection
    • AlpcMessage
    • AlpcOwnedPort
    • AlpcPort
    • AlpcProcessPorts
    • AlpcQueue
    • Amd64TrapFrame
    • Amd64UnwindCode
    • Amd64UnwindInfo
    • Apc
    • ApcQueues
    • ApcSelection
    • ApcThread
    • Arm64EpilogScope
    • Arm64PackedUnwind
    • Arm64TrapFrame
    • Arm64UnwindCode
    • Arm64XdataUnwind
    • AttachedDevice
    • BackendCapability
    • BigPoolAllocation
    • BlackboxStream
    • BreakpointStatus
    • Bugcheck
    • BugcheckArgument
    • BugcheckFault
    • BugcheckTrapFrame
    • CacheAttribute
    • CachedFile
    • CallTrace
    • CallTraceFrame
    • CodeViewRecord
    • ControlArea
    • ControlAreaSegment
    • CpuFeatureBits
    • CpuInfo
    • CpuTriageFallback
    • CrashContext
    • Culprit
    • CulpritEvidence
    • DebugLog
    • DebugLogLine
    • DecodedHypercall
    • DescriptorRegister
    • DeviceObject
    • DeviceStack
    • DeviceStackLayer
    • DevNode
    • DevNodeHistoryState
    • DevNodeSummary
    • DisassembledInstruction
    • Dpc
    • DpcQueue
    • DpcQueues
    • DriverDeviceLink
    • DriverObject
    • DriverObjectSummary
    • DumpException
    • DumpSystemInfo
    • EptDifference
    • EptMapping
    • ErrorCode
    • EtwBuffer
    • EtwEvent
    • EtwEventClass
    • EtwEventDescriptor
    • EtwEventDump
    • EtwEventIssue
    • EtwEventMessage
    • EtwExtendedData
    • EtwLogger
    • EtwLoggerBuffers
    • EtwLoggerTable
    • ExceptionPolicy
    • ExceptionRecord
    • ExecutiveObject
    • ExecutiveResource
    • ExitFilter
    • Export
    • ExpressionValue
    • FailureSignature
    • Field
    • FileCache
    • FileObject
    • FindStack
    • FindStackThread
    • FltFilter
    • FltFilterFrame
    • FltFilters
    • FltInstance
    • FltInstanceFrame
    • FltInstances
    • FltVolume
    • FltVolumeFrame
    • FltVolumes
    • FunctionEntry
    • Gdt
    • GdtDescriptor
    • GlobalFlag
    • GlobalFlags
    • HandleEntry
    • HandleTable
    • HandleTrace
    • HandleTraceFrame
    • HandleTraces
    • HeapBlock
    • HeapBlockSearch
    • HeapDetail
    • HeapIdentity
    • HeapLargeAllocation
    • HeapMatchLarge
    • HeapMatchLfhBlock
    • HeapMatchNtEntry
    • HeapMatchNtLfhBlock
    • HeapMatchNtSegment
    • HeapMatchNtVirtual
    • HeapMatchPage
    • HeapMatchRange
    • HeapMatchVsChunk
    • HeapOverview
    • HeapPageRange
    • HeapStats
    • HeapSummary
    • HeapWalkStop
    • Hypercall
    • HypercallElement
    • HypercallField
    • HypercallFilter
    • HypervisorProcessor
    • Idt
    • IdtGate
    • ImageByteDiff
    • ImageCheck
    • ImageDataDirectory
    • ImageDebugEntry
    • ImageExportDirectory
    • ImageExports
    • ImageFileHeader
    • ImageHeaders
    • ImageImport
    • ImageImportDescriptor
    • ImageMismatchRange
    • ImageOptionalHeader
    • ImageSectionCheck
    • ImageSectionHeader
    • ImageSelfPatchCounts
    • ImageSelfPatchRange
    • InFlightIrp
    • IoIntercepts
    • IoStackLocation
    • IoWorkItem
    • IpiProcessor
    • IpiRequest
    • IpiState
    • Irp
    • IrpDispatchRoutine
    • IrpFindCriteria
    • IrpFindResult
    • Irql
    • Job
    • JobAccounting
    • JobLimits
    • KernelTimer
    • LastError
    • LastError32
    • LfhSubsegment
    • ListEnd
    • LoadedModule
    • LoaderListHead
    • LoaderLists
    • LoaderModule
    • LoaderModules
    • LoaderTerminations
    • LocalVariableLocation
    • LookasideList
    • LookasideLists
    • Mdl
    • MemoryBasicInformation
    • MemoryRegion
    • MemorySearchMatch
    • ModuleEventPolicy
    • ModuleImageInfo
    • ModuleSymbols
    • MsrIntercepts
    • MsrRange
    • NotifyCallback
    • NtHeap
    • NtHeapEntry
    • NtHeapSegment
    • NtLfhUserBlocks
    • NtUncommittedRange
    • NtVirtualBlock
    • ObjectDirectoryEntry
    • ObjectSecurity
    • Operand
    • PageLocation
    • PageTableEntry
    • PartitionFilter
    • PciBar
    • PciBus
    • PciBuses
    • PciCapability
    • PciConfigBytes
    • PciFunction
    • PciScan
    • PciSegment
    • PciTree
    • PciTreeDevice
    • Pcr
    • Peb
    • Peb32
    • Pfn
    • PfnSelector
    • PhysicalMapping
    • PnpTriage
    • PoolBlock
    • PoolIrp
    • PoolMatch
    • PoolPage
    • PoolProblem
    • PoolRangeScan
    • PoolRegion
    • PoolSearch
    • PoolTag
    • PoolTagUsage
    • PoolUsage
    • PoolValidation
    • PortRange
    • Prcb
    • ProcedureLocal
    • ProcessGlobalFlags
    • ProcessIdentity
    • ProcessMemoryUsage
    • ProcessorError
    • ProcessorStateArea
    • ProcessParameters
    • QueuedLock
    • QueuedLockHolder
    • QueuedLocks
    • ReadyQueue
    • ReadyQueues
    • ReadyThread
    • RegisterValue
    • ResourceList
    • ResourceOwner
    • ReverseTranslation
    • RunningProcessor
    • RunningProcessors
    • RunStatus
    • RuntimeFunction
    • SavedVtlState
    • SchedulerError
    • Section
    • SecurityDescriptor
    • SegmentHeap
    • SegmentHeapContext
    • SegmentHeapKeys
    • SegmentHeapPageSegment
    • ServedVp
    • Session
    • Sessions
    • Sid
    • SidAndAttributes
    • SourceLocation
    • SpecialRegistersArea
    • SsdtEntry
    • SsdtTable
    • StackFrame
    • Subsection
    • Symbol
    • SymbolCandidate
    • SymbolLoadDiagnostic
    • SymbolReloadReport
    • SymbolSearchMatch
    • SystemMemoryUsage
    • SystemPteRun
    • SystemPtes
    • SystemPteType
    • TargetDump
    • TargetKernel
    • TargetTime
    • TargetVersion
    • Teb
    • Teb32
    • ThreadStack
    • ThreadStacks
    • ThreadSummary
    • TimerBucketEnd
    • TimerTable
    • TimerTableEntry
    • Token
    • TokenPrivilege
    • TrapFrame
    • TriagePrcb
    • TriageReport
    • UniqStackGroup
    • UniqStacks
    • UniqStackScope
    • UnloadedDriver
    • UnwalkedThread
    • UnwindHandler
    • VcpuStatus
    • Verifier
    • VerifierDriver
    • VerifierDriverSummary
    • VerifierFinding
    • VerifierFindingAddress
    • VerifierFindingArgument
    • VerifierStatistics
    • VerifierSuspectDriver
    • VmCounter
    • VmPool
    • VmPte
    • VmStatistics
    • Vpb
    • VpRegisters
    • VsChunk
    • VsSubsegment
    • WdfCallback
    • WdfClient
    • WdfContext
    • WdfDevice
    • WdfDriverDevice
    • WdfDriverInfo
    • WdfHandle
    • WdfLoader
    • WdfLog
    • WdfLogRecord
    • WdfObjectRef
    • WdfQueue
    • WdfQueueSummary
    • WdfRequest
    • WdfState
    • WdfVersion
    • WheaFinding
    • WheaRecord
    • WheaSection
    • WorkerThread
    • WorkItem
    • WorkQueue
    • WorkQueuePriority
    • WorkQueues
    • ZombieProcess
    • Zombies
    • ZombieThread

Reference

  • Commands
    • Execution and stack
    • Breakpoints and events
    • Memory and disassembly
    • Symbols, types, and expressions
    • Processes and modules
    • User mode
    • CPU
    • Memory manager
    • Objects and I/O
    • Security
    • Analysis
    • Target control
    • Session
  • Expressions

Internals

  • Reading memory over KD
  • Rust crate API (docs.rs)

Resources

  • Changelog
  • Source code
  • Releases
  • Bug reports
  • Discussions
  • PyPI package
  • crates.io
Back to top
View this page
Edit this page

ExceptionPolicyIterator¶

final class ntoseye.ExceptionPolicyIterator¶

Iterator over dbg.exceptions.

__iter__() → ExceptionPolicyIterator¶
Next
Exceptions
Previous
Drivers
Copyright © dmaivel
Made with Sphinx and @pradyunsg's Furo
On this page
  • ExceptionPolicyIterator
    • ExceptionPolicyIterator
      • ExceptionPolicyIterator.__iter__()