Exceptions

final class ntoseye.Exceptions

The stop policy for each exception (dbg.exceptions, sx*).

__iter__() → Iterator[ExceptionPolicy]

__len__() → int

property module_events: list[ModuleEventPolicy]

The module load and unload filters (sx* ld[:<module>] and sx* ud[:<module>]), in the order that you set them. Iterating over dbg.exceptions gives only the exception policies.

reset() → None

Remove all configured policies and module load and unload filters, so ordinary exceptions break by default and module loads and unloads do not stop (sxr).

set(code: int | str, *, mode: Literal['break', 'second_chance', 'notify', 'ignore'] | None = None, command: str | None = None, disposition: Literal['break', 'handled', 'not_handled'] | None = None) → ExceptionPolicy

Set how the debugger handles an exception, by NTSTATUS code or WinDbg alias (av, bpe, …), and return its policy.

mode is break (the default), second_chance, notify or ignore. command runs at the event; disposition then breaks, or continues the exception as handled or not handled, and defaults to what mode does. For a module load or unload filter, use set_module_event.

set_module_event(event: Literal['ld', 'ud'], module: str | None = None, *, mode: Literal['break', 'second_chance', 'notify', 'ignore'] | None = None, command: str | None = None) → ModuleEventPolicy

Set a filter for a kernel module load (ld) or unload (ud), and return it.

module limits it to one image (a case-insensitive name; the extension is optional, and */? globs match); without it, the filter applies to every image. mode is break (the default; a load stops after ntoseye lists the module and arms its deferred breakpoints, an unload while the image is still listed), notify (a ModLoad: or Unload module notice, then the target continues), or second_chance or ignore (it continues). command runs at the stop, so only with break. A named filter has precedence over a bare one.