ModuleInfo

final class ntoseye.ModuleInfo

Subclass of BaseRecord.

A loaded module (kernel or process image), as its loader list records it.

property base: int

The base address of the loaded image.

property checksum: int | None

property end: int

The address after the last byte of the image.

property entry_point: int | None

property file_version: str | None

The file version from the version resource of the image.

property is_32bit: bool

From a WOW64 process’s 32-bit loader list: x86 code, 4-byte pointers.

property name: str

The image name.

property path: str | None

The full image path, if the loader recorded one.

property product_version: str | None

The product version from the version resource of the image.

property short_name: str

The name without its extension, as nt! and lm name the module (nt for the kernel).

property size: int

The size of the mapped image.

property timestamp: int | None

The PE timestamp, if the loader record contains one.