Module

final class ntoseye.Module

One loaded image in the kernel address space or in a process address space.

__getitem__(name: str, /) → int

Get the address of a symbol in this module.

property base: int

The base address of the loaded image.

check_image(*, include_diffs: bool = False) → ImageCheck

Compare the executable sections of a module with the cached on-disk image.

Compares the .text, PAGE*, and INIT executable sections after applying the DIR64/HIGHLOW relocations, and skips discardable and paged-out sections. The command counts known kernel self-patches separately: import optimization, retpoline, KiPatchSelf retargets, and the addresses of the kernel VA regions that the kernel moves at boot, and, by the image’s data directories and the kernel’s symbols, the import address table the loader fills, nt!KiServiceTable, which the kernel packs at boot, and the instructions at its patch labels (SwapContext_PatchXSave) that it rewrites for the processor. With -nospec, the command does not show this breakdown and reports the self-patches as ordinary mismatches. -d prints byte diffs, up to a limit, and -v prints the results for each section.

property checksum: int | None

property end: int

The address after the last byte of the image.

property entry_point: int | None

property exports: list[ModuleExportInfo]

The exports from the mapped PE export directory.

fetch_image() → str

Download the module’s PE file into the symbol cache and return its path there (.fetchimage). The file is found by the TimeDateStamp and SizeOfImage values in the module’s mapped PE header, the symbol-server key, so it is the same build that is running; a copy in a local directory on the symbol path is used before a symbol server.

property file_version: str | None

The file version from the version resource of the image.

headers(*, exports: bool = False, imports: bool = False) → ImageHeaders

Show the headers of a mapped PE image.

The argument is a module name, an address, or an image base. A module name is nt, hal, ntdll, or the image name of the module, and ntoseye looks for it in the .process module list first, and then in the kernel module list. An address can be any address inside a loaded module. An image base can be the base of an image that no loader list contains, if that image starts with MZ. With no options, the command shows the file and section headers, as WinDbg does. -f: the file header, the optional header (entry point, image base, subsystem, DLL characteristics, stack and heap sizes), and the data directories (RVA and size). For the security directory, the value is a file offset. -s: the section table with decoded flags, and the debug directory with its CodeView PDB name, GUID, and age. -e: the export directory and all exports (ordinal, RVA, name or forwarder). -i: each import descriptor and its imports (hint and name or ordinal), with the address that the loader bound in the IAT. If a descriptor has no import name table, the command shows only the bound addresses, because its IAT no longer contains names. -a: all of these. You can combine options (-fs, -f -i). If ntoseye cannot read a directory, it shows the directory as unavailable and shows the other data. For example, the import table of a driver is in its INIT section, and Windows discards that section after load. The same applies to an import name or a module name that ntoseye cannot read. The command reads the headers from memory as they are mapped, so the values are the ones that the loader left there.

image(*, zero_fill: bool = False) → bytes

The mapped image in memory layout, for pefile/LIEF. A page that is not readable raises MemoryAccessError, unless zero_fill is set, which fills such pages with zeros (for example, a kernel’s discarded INIT section).

image_info() → ModuleImageInfo

Show the image identity, debug directory, and symbol state of a loaded module.

The argument is a module name as for !dh (nt, ntdll, an image name), or any address inside the module. From the mapped headers, the command shows the base, image name and path, machine, time stamp, size, checksum, and characteristics. It also shows the debug directory with the CodeView PDB name, GUID, and age. Last, it shows whether symbols are loaded, where they come from, and the local PDB file.

property info: ModuleInfo

The ModuleInfo record of this handle: its properties as one value.

inspect() → ModuleListing | LoaderModule

The symbol status, load diagnostics, and PDB identity (lmv).

property is_32bit: bool

From a WOW64 process’s 32-bit loader list: x86 code, 4-byte pointers.

property name: str

The image name.

property path: str | None

The full image path, if the loader recorded one.

property product_version: str | None

The product version from the version resource of the image.

reload_symbols() → ModuleSymbolLoadReport

Force ntoseye to select the symbol source and index the symbols for one module.

property sections: list[Section]

The PE sections and their mapped permissions.

property short_name: str

The name without its extension, as nt! and lm name the module (nt for the kernel).

property size: int

The size of the mapped image.

property symbols: ModuleSymbols

The symbol status and PDB identity of the module (lmv).

property timestamp: int | None

The PE timestamp, if the loader record contains one.

to_dict() → dict[str, Any]

The record (info) as a plain dict.

verifier() → VerifierDriver

Get the verifier data for this driver module (!verifier <module>).