Memory

final class ntoseye.Memory

A guest address space: dbg.memory (kernel), proc.memory, dbg.physical.

describe(addr: int) → Record

Describe the loaded module, kernel region, or process VAD containing addr.

disassemble(addr: int, count: int) → list[Record]

Disassemble count instructions at addr (u).

disassemble_back(addr: int, count: int) → list[Record]

Disassemble the count instructions ending at addr (ub).

disassemble_function(addr: int) → list[Record]

Disassemble the runtime function containing addr (uf).

property dtb: int

The directory-table base used by this space.

page_in(addr: int) → bool

Make addr resident with the guest debugger worker (.pagein). The worker resumes the guest and returns with it stopped at its completion; that stop is reflected by dbg.stop.

property pointer_size: int

The guest pointer width in bytes ($ptrsize).

ptov(physical: int) → Record

Reverse-map a physical address through this space’s page tables (!ptov).

read(addr: int, n: int) → bytes

Read n bytes; virtual reads mask this debugger’s breakpoint opcodes.

read_ansi_string(addr: int, bits: int | None = None) → str

Decode the _STRING/ANSI_STRING descriptor at addr (ds). bits selects the layout as for read_unicode_string.

read_pointer(addr: int) → int

Read a pointer-sized value at addr (poi).

read_string(addr: int, max_len: int = 256) → str

Read a NUL-terminated ANSI string at addr (da).

read_u16(addr: int) → int

Read a little-endian 16-bit integer.

read_u32(addr: int) → int

Read a little-endian 32-bit integer.

read_u64(addr: int) → int

Read a little-endian 64-bit integer.

read_u8(addr: int) → int

Read one little-endian byte.

read_unicode_string(addr: int, bits: int | None = None) → str

Decode the _UNICODE_STRING descriptor at addr (dS). bits selects the layout: 32 for a WOW64 process’s x86 descriptors, 64 for native ones; by default the .effmach setting decides.

read_wstring(addr: int, max_len: int = 256) → str

Read a NUL-terminated UTF-16 string at addr (du).

search(pattern: bytes, start: int, length: int) → list[MemorySearchMatch]

Find overlapping matches and include symbol/module/VAD context.

translate(addr: int) → int | None

Translate a virtual address through this space’s page tables (!vtop).

translation(addr: int) → Record

The full page-table walk and final translation (!pte + !vtop).

write(addr: int, data: bytes) → None

Write bytes to this address space.

write_u16(addr: int, value: int) → None

Write a little-endian 16-bit integer.

write_u32(addr: int, value: int) → None

Write a little-endian 32-bit integer.

write_u64(addr: int, value: int) → None

Write a little-endian 64-bit integer.

write_u8(addr: int, value: int) → None

Write a little-endian byte.