Memory¶

final class ntoseye.Memory¶

A guest address space: dbg.memory (kernel), proc.memory, cpu.memory, or dbg.physical.

describe(address: int | str | Process | Thread | Module | Driver | Device | Heap) → AddressDescription¶: Describe what address belongs to (!address <address>): its kind (a kernel module, a user image, a kernel region, private or mapped user memory), the module or VAD that holds it, and its protection. On a user-mode minidump, Debugger.user_dump.address_report(address) reads the dump’s memory-info list instead.

Disassemble memory at a symbol or address.

L<count> sets the number of instructions, 8 by default. If you give an end address, the command shows all instructions that start at or before that address. If you do not give an address, the command continues after the last instruction that the previous u showed. After the target runs or steps, or when you select another frame, thread, or process, it starts at the instruction pointer instead.

disassemble_back(address: int | str | Process | Thread | Module | Driver | Device | Heap, count: int) → list[DisasmRow]¶: Disassemble the instructions that end at an address.

Disassemble the function that contains an address.

The function’s runtime function entry gives its extent. A leaf function has none, so uf reads it from its symbol for as far as its control flow reaches before the next symbol: it follows the branches inside the function, and treats a branch past the next symbol as a tail call.

property dtb: int¶: The directory-table base that this space uses. A user-mode minidump has none, and raises NtoseyeError.

Show the function table entry and unwind info of the function that contains an address.

Shows the RUNTIME_FUNCTION that covers the address (the begin, end, and unwind info RVAs), then its unwind data. On AMD64, the unwind data is the UNWIND_INFO version, flags, prolog size, frame register, and frame offset, each unwind code with its operands, and the exception or termination handler. After a chained entry, .fnent shows the entry of each parent. On ARM64, it shows the fields of packed unwind data (flag, RegF, RegI, H, CR, frame size) and the prolog codes that they represent. For an .xdata record, it shows the header, the epilog scopes, each unwind code with the instruction that it undoes, and the exception handler. If a function table is paged out, .fnent reads it from the image file on disk.

page_in(address: int | str | Process | Thread | Module | Driver | Device | Heap) → bool¶: Make address resident with the guest debugger worker (.pagein), which resumes the guest. When the worker completes, the guest stops and the method returns, and dbg.stop shows that stop.

property pointer_size: int¶: The guest pointer width, in bytes ($ptrsize).

pte(address: int | str | Process | Thread | Module | Driver | Device | Heap) → PteWalk¶: Show the page table entries for an address.

ptov(physical: int) → PtovDetail¶

Find the virtual addresses in the current directory base that map a physical address.

The command walks the page tables in reverse and detects cycles in them. The walk stops after 32 mappings or 65,536 table pages. It works on AMD64 targets only.

read(address: int | str | Process | Thread | Module | Driver | Device | Heap, size: int) → bytes¶: Read size bytes. A virtual read hides the breakpoint opcodes of this debugger.

read_ansi_string(address: int | str | Process | Thread | Module | Driver | Device | Heap, *, bits: int | None = None) → str¶: Decode the _STRING/ANSI_STRING descriptor at address (ds). bits sets the layout, as in read_unicode_string.

read_pointer(address: int | str | Process | Thread | Module | Driver | Device | Heap) → int¶: Read a pointer-sized value at address (poi).

read_string(address: int | str | Process | Thread | Module | Driver | Device | Heap, *, max_len: int = 256) → str¶: Read a NUL-terminated ANSI string at address (da).

read_u16(address: int | str | Process | Thread | Module | Driver | Device | Heap) → int¶: Read a little-endian 16-bit integer.

read_u32(address: int | str | Process | Thread | Module | Driver | Device | Heap) → int¶: Read a little-endian 32-bit integer.

read_u64(address: int | str | Process | Thread | Module | Driver | Device | Heap) → int¶: Read a little-endian 64-bit integer.

read_u8(address: int | str | Process | Thread | Module | Driver | Device | Heap) → int¶: Read a little-endian byte.

read_unicode_string(address: int | str | Process | Thread | Module | Driver | Device | Heap, *, bits: int | None = None) → str¶: Decode the _UNICODE_STRING descriptor at address (dS). bits sets the layout: 32 for the x86 descriptors of a WOW64 process and 64 for native descriptors. By default, the .effmach setting selects the layout.

read_wstring(address: int | str | Process | Thread | Module | Driver | Device | Heap, *, max_len: int = 256) → str¶: Read a NUL-terminated UTF-16 string at address (du).

search(pattern: bytes, start: int | str | Process | Thread | Module | Driver | Device | Heap, length: int) → list[MemorySearchMatch]¶: Find matches, including overlapping ones, with symbol/module/VAD context. The search skips pages that it cannot read and returns a maximum of 4096 matches; in a virtual space, the breakpoints of this session read as the code that they replaced.

translate(address: int | str | Process | Thread | Module | Driver | Device | Heap) → int | None¶: Translate a virtual address with the page tables of this space (!vtop).

translation(address: int | str | Process | Thread | Module | Driver | Device | Heap) → VtopDetail¶: Get the page-table walk and the final translation of address in this space’s page tables (!vtop with this space’s DTB). It works in every virtual space, VTL1 and roots outside NT included.

write(address: int | str | Process | Thread | Module | Driver | Device | Heap, data: bytes) → None¶: Write bytes to this address space.

write_u16(address: int | str | Process | Thread | Module | Driver | Device | Heap, value: int) → None¶: Write a little-endian 16-bit integer.

write_u32(address: int | str | Process | Thread | Module | Driver | Device | Heap, value: int) → None¶: Write a little-endian 32-bit integer.

write_u64(address: int | str | Process | Thread | Module | Driver | Device | Heap, value: int) → None¶: Write a little-endian 64-bit integer.

write_u8(address: int | str | Process | Thread | Module | Driver | Device | Heap, value: int) → None¶: Write a little-endian byte.