Module

final class ntoseye.Module

One loaded image in the kernel or a process address space.

__getitem__(name: str, /) → int

Resolve a symbol from this module to its address.

property base: int

Base address of the loaded image.

check_image(include_diffs: bool = False) → Record

Compare executable sections against the cached image (!chkimg).

property exports: list[Export]

Exports from the mapped PE export directory.

fetch_image() → str

Fetch the matching image from the symbol server cache (.fetchimage).

property file_version: str | None

File version from the image’s version resource.

image(zero_fill: bool = False) → bytes

The mapped image in memory layout, for pefile/LIEF. Raises MemoryAccessError on an unreadable page unless zero_fill is set, which zeroes such pages instead (a kernel’s discarded INIT section).

inspect() → Record

Symbol status, load diagnostics and PDB identity (lmv).

property name: str

Image name.

property path: str | None

Full image path, when the loader recorded one.

property product_version: str | None

Product version from the image’s version resource.

reload_symbols() → Record

Select, fetch, and index symbols for this module (ld, .reload).

property sections: list[Section]

PE sections and their mapped permissions.

property size: int

Size of the mapped image.

property symbols: Record

Module symbol and PDB identity (lmv).

property timestamp: int | None

PE timestamp, when present in the loader record.

to_dict() → dict[str, Any]

The module as a plain dict, the shape MCP renders.

verifier() → Record

Return verifier data for this driver module.