Inspect

final class ntoseye.Inspect

System-wide reports and decode-by-address helpers (dbg.inspect); the results are Records shaped like the MCP JSON output.

acl(address: int) → Record

Decode an ACL and its ACEs (!acl).

apcs(target: Process | Thread | int | None = None) → Record

Decode kernel and user APC queues for all threads, a process, or a thread (!apc).

bugcheck() → Record | None

Analyze the current bugcheck, or return None when the target is not bugchecking.

callbacks() → list[Record]

Enumerate process, thread, and image notification callbacks.

context_record(address: int) → Frame

Decode a CONTEXT record and return its register set as a Frame (.cxr).

device(address: int) → Device

Return a handle for the _DEVICE_OBJECT at address (!devobj).

device_stack(device_or_node: Device | int) → Record

Decode the device stack containing a device object or devnode (!devstack).

devnode(node: int | None = None, recurse: bool = False) → Record

Decode a PnP device node and optionally its bounded subtree (!devnode).

dpcs() → Record

Report DPCs queued on each processor (!dpcs).

exception_record(address: int) → Record

Decode an EXCEPTION_RECORD64 (.exr).

file_object(address: int) → Record

Decode a _FILE_OBJECT (!fileobj).

irp(address: int) → Record

Decode an in-flight _IRP and its current I/O stack location (!irp).

irps(filter: str | None = None) → list[Record]

Find in-flight IRPs, optionally filtered by process or driver (irps).

lookaside(address: int) → Record

Decode one GENERAL_LOOKASIDE (!lookaside address).

lookasides() → Record

List exported nonpaged and paged GENERAL_LOOKASIDE lists (!lookaside).

memusage(process_limit: int = 64) → Record

Return bounded system and per-process memory-use counters (!memusage).

object(address: int) → Record

Decode an executive object header and resolve its type and name (!object).

object_security(object: int) → Record

Decode the security descriptor referenced by an object’s header (!objsd).

peb(process: Process, address: int | None = None) → Record

Decode a process PEB and its parameters and loader-list heads (!peb).

pfn(value: int, physical_address: bool = False) → Record

Decode an _MMPFN by page-frame number or physical address (!pfn).

pnp_triage() → Record

Report device nodes with PnP problems (!pnptriage).

pool(address: int) → Record

Decode the pool page or big-pool allocation containing address (!pool).

pool_find(tag: str, pool_type: str | None = None) → Record

Find pool allocations by tag, optionally restricted to a pool type (!poolfind).

pool_usage(tag: str | None = None, *, sort: str = 'tag', include_counts: bool = False) → Record

Aggregate pool tracker usage by tag (!poolused).

ready(processor: int | None = None) → Record

Read bounded dispatcher-ready queues for every processor or one (!ready).

resource(address: int) → Record

Decode an executive resource (!locks address).

resources(limit: int = 256) → Record

Enumerate the symbol-backed executive-resource list (!locks).

running(include_idle: bool = False, include_stacks: bool = False) → Record

Report current, next, and idle threads on each processor (!running).

security_descriptor(address: int, annotate_well_known: bool = False) → Record

Decode a security descriptor, including owner/group SIDs and ACLs (!sd).

sessions(session: int | None = None) → Record

List sessions and their processes, optionally selecting one (!session).

sid(address: int) → Record

Decode a SID to its string form, authority, and well-known name (!sid).

ssdt() → list[Record]

Dump the kernel SSDT and initialized win32k shadow table (!ssdt).

stacks(level: int = 0, filter: str | None = None) → Record

Report thread states, wait reasons, and bounded stacks (!stacks).

teb(thread: Thread, address: int | None = None) → Record

Decode a thread TEB and its WOW64 companion (!teb).

time() → Record

Report target system time and uptime (.time).

timer(address: int) → Record

Decode a _KTIMER and its DPC (!timer address).

timers() → Record

Read bounded kernel timer-table entries and their DPCs (!timer).

trap_frame(address: int) → Record

Decode a _KTRAP_FRAME at address (.trap).

triage() → Record

Build the structured one-shot crash/debug report (!analyze).

verifier() → Record

Report Driver Verifier configuration and statistics (!verifier).

version() → Record

Target, kernel, symbol, processor, and debugger version information (vertarget).

vm(include_processes: bool = True) → Record

Report system memory, pool, PTE, and page-file counters (!vm).