NtEntry

final class ntoseye.NtEntry

Subclass of BaseRecord.

An NT-heap entry (_HEAP_ENTRY), decoded from its header.

property address: int

The entry header.

property checksum_ok: bool

Whether the XOR checksum of the header is correct. Always true if the headers are not encoded.

property flags: int

The flags byte of the header.

property granule: int

The header size in bytes (see granule).

property previous_size: int

The size in bytes of the previous entry.

property size: int

The size in bytes, with the header.

property state: Literal['busy', 'free']

busy or free.

property unused_bytes: int

The number of unused bytes at the end of the block.

property user: int

First user byte.

property user_size: int

The number of bytes that the caller requested: the block size minus the unused bytes, which ntdll counts with the header’s overhead in them (an x64 header’s first qword holds the previous block’s data, so only its second is overhead). A free block was requested by no one and its header counts no unused bytes, so its size is the space after the header.