IrpInfo¶

final class ntoseye.IrpInfo¶

Subclass of BaseRecord.

An _IRP and its I/O stack locations (!irp).

property address: int¶

property current_location: int¶: CurrentLocation, which is more than stack_count after the IRP completes.

property current_stack: IoStackLocationInfo | None¶: The location that CurrentLocation names. None if the current location is out of range or ntoseye cannot read it.

property io_status: int | None¶: IoStatus.Status as an NTSTATUS. None if ntoseye cannot read it.

property mdl_address: int¶

property pending_returned: bool¶

property requestor_mode: int¶: 0 for KernelMode, 1 for UserMode.

property size: int¶: Size in bytes, including the stack locations.

property stack: list[IoStackLocationInfo]¶: Every stack location, from location 1 (the lowest driver’s) to stack_count, ending early at one ntoseye cannot read; empty when StackCount is implausible.

property stack_count: int¶

property system_buffer: int¶: AssociatedIrp.SystemBuffer, the copy of the data for buffered I/O.

property thread: int¶: Tail.Overlay.Thread, the thread that issued the IRP.

property type: int¶: Type, which is IO_TYPE_IRP (6) for a valid IRP.

property user_buffer: int¶

property user_event: int¶