NtEntryDetail

final class ntoseye.NtEntryDetail

Subclass of BaseRecord.

An NT-heap entry with the legacy-LFH region it holds.

property header: NtEntry

property lfh: NtUserBlocks | None

The legacy-LFH user block region in this busy entry. None if the entry has no region or ntoseye cannot read it.

property lfh_blocks: list[HeapBlock]

The blocks of the region.

property lfh_error: str | None

The reason that ntoseye could not read the LFH region of the entry.

property lfh_truncated: bool

Whether lfh_blocks stops at the walk limit.