HvVtl

final class ntoseye.HvVtl

Subclass of BaseRecord.

One VTL of a virtual processor: the hypervisor’s context for it and, when found, its eVMCS and the guest state saved there.

property context: int

The address of the hypervisor’s context object for this VTL.

property ept_pointer: int | None

The VTL’s EPT pointer, the root of its second-level address translation, or None without the eVMCS.

property exit_reason: int | None

The basic reason (Intel SDM Appendix C) the VTL last left for the hypervisor, or None without the eVMCS.

property level: int

The VTL (0 for NT, 1 for the secure kernel).

property rip: int | None

The guest RIP where the VTL left off, or None without the eVMCS.

property vmcs: int | None

The physical address of the VTL’s VMCS (an eVMCS under KVM), or None when ntoseye did not find where the context keeps it (no hv-evmcs).