Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
ntoseye
Logo
ntoseye

Getting started

  • Install
  • Quickstart
  • Your first session
  • Coming from WinDbg
  • Troubleshooting
  • Command line

Setting up a target

  • Choosing a backend
  • KVM/QEMU
  • VMware Workstation
  • UTM (macOS, Apple Silicon)
  • KDNET

Using ntoseye

  • Using the REPL
  • Breakpoints and watchpoints
  • Memory and paging
  • Symbols and source
  • Bugchecks
  • Crash dumps
  • Driver replacement map (.kdfiles)
  • KMDF drivers (!wdfkd)
  • Virtio devices (!virtio, !vring)
  • StorPort adapters (!storagekd.*)
  • Network miniports (!ndiskd.*)
  • The registry (!reg)
  • Developing drivers from a Linux host

Platform topics

  • WOW64 processes

VBS and the Windows hypervisor

  • Overview
  • Debugging a Windows Sandbox
  • The secure kernel (VTL1)
  • Partitions and virtual processors
  • Guest partitions
  • Hypercalls and VM exits
  • Stops in the Windows hypervisor
  • VBS internals

Integrations

  • Editor integration (DAP)
  • Disassembler integration (GDB remote protocol)
  • MCP integration

Scripting

  • Python SDK
  • Custom REPL commands
  • Python API
    • BaseRecord
    • Breakpoint
    • Breakpoints
    • Cpu
    • Cpus
    • Debugger
    • Device
    • Diagnostic
    • Driver
    • Drivers
    • Exceptions
    • Frame
    • Heap
    • Heaps
    • HypercallCaller
    • HypervisorPartition
    • HypervisorVtl
    • Inspect
    • Memory
    • MemoryAccessError
    • Module
    • Modules
    • Msrs
    • NtoseyeError
    • Process
    • Processes
    • Regions
    • Registers
    • SecureKernel
    • StaleHandleError
    • Struct
    • SymbolNotFoundError
    • Symbols
    • TargetRunningError
    • Thread
    • Threads
    • Trustlet
    • Type
    • Types
    • UserDump
    • UserProcess
    • UserThread
    • UserThreads
    • VirtualProcessor
    • Ace
    • Acl
    • AddressDescription
    • AddressModule
    • AddressSummary
    • AlpcClientPort
    • AlpcConnection
    • AlpcField
    • AlpcMessage
    • AlpcOwnedPort
    • AlpcPort
    • AlpcProcessPorts
    • AlpcQueue
    • Amd64TrapFrame
    • Amd64UnwindCode
    • Amd64UnwindInfo
    • Apc
    • ApcQueues
    • ApcSelector
    • ApcThread
    • ApicIcr
    • ApicLvt
    • Arm64EpilogScope
    • Arm64PackedUnwind
    • Arm64TrapFrame
    • Arm64UnwindCode
    • Arm64XdataUnwind
    • AttachedDevice
    • BackendCapability
    • BigPoolDetail
    • BlackboxFinding
    • BlackboxState
    • BlockedIrp
    • BlockMatch
    • BootStatus
    • BreakpointCommands
    • BreakpointHit
    • BreakpointInfo
    • BsdErrorInfo
    • BugcheckAnalysis
    • BugcheckArg
    • BugcheckDecoding
    • BugcheckFault
    • BugcheckInfo
    • BugcheckTrapFrame
    • CacheAttribute
    • CachedFile
    • CallTrace
    • CallTraceFrame
    • CapturedRange
    • CapturedStack
    • CellLocation
    • ClassDevice
    • ClassDeviceDetail
    • ClassDevices
    • ClassError
    • ClassTransferPacket
    • ClassUnreadable
    • CodeOwner
    • CodeView
    • ControlAreaDetail
    • CpuFeatureBits
    • CpuInfo
    • CpuTriageFallback
    • CriticalSection
    • CriticalSections
    • CulpritAttribution
    • CulpritEvidence
    • CulpritSubject
    • DataDirectory
    • DebugLine
    • DebugOutputPage
    • DebugRecord
    • DecodedHypercall
    • DescriptorRegister
    • DeviceDriver
    • DeviceNotifyState
    • DeviceObjectDetail
    • DevicePower
    • DeviceStackDetail
    • DeviceStackEntry
    • DevNodeDetail
    • DevNodePower
    • DevNodeSummary
    • DisasmOperand
    • DisasmRow
    • DmpException
    • DmpSystemInfo
    • Dpc
    • DpcQueue
    • DpcQueues
    • DriverDeviceLink
    • DriverObjectDetail
    • DriverObjectInfo
    • DriverQueueState
    • DumpWrite
    • DynamicCodeCulprit
    • EptDifference
    • EptMapping
    • ErrorCode
    • EtwBuffer
    • EtwBufferIssue
    • EtwDumpData
    • EtwDumpLogger
    • EtwEvent
    • EtwEventClass
    • EtwEventDescriptor
    • EtwEventDump
    • EtwExtendedItem
    • EtwLogFile
    • EtwLogger
    • EtwLoggerBuffers
    • EtwLoggerTable
    • EtwLogSave
    • EtwMessage
    • EtwMessageFormat
    • EtwRecord
    • EventPolicies
    • ExceptionParameter
    • ExceptionPolicy
    • ExceptionRecord
    • ExceptionStop
    • ExecutiveResource
    • ExitFilter
    • ExportDirectory
    • FailureSignature
    • FieldInfo
    • FileCacheDetail
    • FileHeader
    • FileObject
    • FindStack
    • FindStackThread
    • FltFilterDetail
    • FltFilterFrame
    • FltFilters
    • FltInstanceDetail
    • FltInstanceFrame
    • FltInstances
    • FltVolumeDetail
    • FltVolumeFrame
    • FltVolumes
    • FunctionDisassembly
    • FunctionEntry
    • Gdt
    • GdtDescriptor
    • GlobalFlag
    • GlobalFlags
    • GlobalFlagUpdate
    • HalController
    • HalControllers
    • HalLine
    • HalLineRange
    • HalUnreadable
    • HandleEntry
    • HandleEventInfo
    • HandleMutantInfo
    • HandleOtherInfo
    • HandleProcessInfo
    • HandleSectionInfo
    • HandleSemaphoreInfo
    • HandleTable
    • HandleThreadInfo
    • HandleTrace
    • HandleTraceFrame
    • HandleTraces
    • HangProcessor
    • HangReport
    • HangThread
    • HeapBlock
    • HeapBlockSearch
    • HeapDetail
    • HeapIdentity
    • HeapInfo
    • HeapStats
    • HeapWalkStop
    • Hive
    • HiveList
    • HvPartition
    • HvProcessor
    • HvVirtualProcessor
    • HvVtl
    • Hypercall
    • HypercallCallerInfo
    • HypercallElement
    • HypercallField
    • HypercallFilter
    • IdleDetection
    • Idt
    • IdtGate
    • IfrEnd
    • IfrRecord
    • ImageByteDiff
    • ImageCheck
    • ImageExports
    • ImageHeaders
    • ImageMismatchRange
    • ImageSectionCheck
    • ImageSelfPatchCounts
    • ImageSelfPatchRange
    • ImportDescriptor
    • ImportEntry
    • IndirectTable
    • IoIntercepts
    • IoStackLocationInfo
    • IoWorkItem
    • IpiField
    • IpiProcessor
    • IpiRequest
    • IpiState
    • IrpDispatchRoutine
    • IrpFindCriteria
    • IrpFindDetail
    • IrpFindEntry
    • IrpHit
    • IrpHolder
    • IrpInfo
    • Irql
    • Job
    • JobAccounting
    • JobLimits
    • KernelTimer
    • KmdfLogFinding
    • KtrapFrame
    • LargeAllocation
    • LastError
    • LastError32
    • LfhSubsegment
    • ListTermination
    • LoaderListHead
    • LoaderLists
    • LoaderModule
    • LoaderModules
    • LocalApic
    • LocalVariableLocation
    • LookasideDetail
    • LookasideListsDetail
    • MdlDetail
    • MemoryBasicInformation
    • MemoryRegion
    • MemoryRegionInfo
    • MemorySearchMatch
    • MinidumpWrite
    • ModuleEventPolicy
    • ModuleExportInfo
    • ModuleImageInfo
    • ModuleInfo
    • ModuleListing
    • ModuleSymbolDiagnostic
    • ModuleSymbolLoadReport
    • ModuleSymbols
    • MsrIntercepts
    • MsrRange
    • NdisDriver
    • NdisDriverList
    • NdisFilter
    • NdisFilterDetail
    • NdisFilterDriver
    • NdisFilterDriverDetail
    • NdisFilterDriverList
    • NdisFilterList
    • NdisMinidriver
    • NdisMiniport
    • NdisMiniportDetail
    • NdisMiniportList
    • NdisNbl
    • NdisNblChain
    • NdisNetBuffer
    • NdisOidRequest
    • NdisOpen
    • NdisPendingOid
    • NdisPendingOids
    • NdisProtocol
    • NdisProtocolBinding
    • NdisProtocolDetail
    • NdisProtocolList
    • NdisUnreadable
    • NonResident
    • Notice
    • NotifyCallback
    • NtEntry
    • NtEntryDetail
    • NtfsRecord
    • NtHeap
    • NtHeapDetail
    • NtSegment
    • NtSegmentDetail
    • NtUncommittedRange
    • NtUserBlocks
    • NtVirtualBlock
    • ObjectDetail
    • ObjectDirectoryEntry
    • ObjectHeaderDetail
    • ObjectSecurity
    • OptionalHeader
    • PackedQueueState
    • PackedRing
    • PageLocation
    • PageRange
    • PageSegment
    • PartitionFilter
    • PciBar
    • PciBuses
    • PciCapability
    • PciFunction
    • PciHeader
    • PciRecord
    • PciScan
    • PciTree
    • PciTreeBus
    • PciTreeDevice
    • PciTreeSegment
    • Pcr
    • Peb
    • Peb32
    • PfnDetail
    • PfnSelector
    • Place
    • PnpBlackbox
    • PnpTriageDetail
    • PoolBlockDetail
    • PoolFindDetail
    • PoolFindMatch
    • PoolFindRange
    • PoolPageDetail
    • PoolProblem
    • PoolRegionDetail
    • PoolTag
    • PoolUsageDetail
    • PoolUsageRow
    • PoolValidationDetail
    • PortRange
    • PowerAction
    • PowerActionDetail
    • PowerButton
    • PowerCulprit
    • PowerEnum
    • PowerFailure
    • PowerFailureFinding
    • PowerFailureThread
    • PowerIrp
    • PowerIrpEntry
    • PowerIrpList
    • PowerState
    • PowerThreadRole
    • PowerTransition
    • PowerWorker
    • PowerWorkerEntry
    • PowerWorkerList
    • Prcb
    • ProcedureLocal
    • ProcessDetail
    • ProcessInfo
    • ProcessMemoryUsage
    • ProcessorError
    • ProcessorStateArea
    • ProcessParameters
    • PteAttributes
    • PteLevel
    • PteWalk
    • PtovDetail
    • PtovMapping
    • QueuedLock
    • QueuedLockHolder
    • QueuedLocks
    • QueueProgress
    • RcdrDriver
    • RcdrDriverList
    • RcdrEntry
    • RcdrLog
    • RcdrLogDump
    • RcdrLogs
    • RcdrPartition
    • RcdrUnreadable
    • RcdrWalkEnd
    • ReadyQueue
    • ReadyQueues
    • ReadyThread
    • RegisterValue
    • RegistryCellError
    • RegistryUnreadable
    • RegKey
    • RegLink
    • RegSubkey
    • RegValue
    • ReloadStop
    • ResourceList
    • ResourceOwner
    • RunningProcessor
    • RunningProcessors
    • RunStatus
    • RuntimeFunction
    • SavedVtl
    • SchedulerError
    • Section
    • SectionHeader
    • SecurityDescriptor
    • SegContext
    • SegmentContextDetail
    • SegmentDetail
    • SegmentHeap
    • SegmentHeapDetail
    • SegmentKeys
    • SegmentPageDetail
    • SegmentRangeDetail
    • ServedVp
    • Session
    • SessionProcess
    • SessionProcesses
    • Sessions
    • Sid
    • SidAndAttributes
    • Signal
    • SmbiosField
    • SmbiosStructure
    • SmbiosTable
    • SourceLocation
    • SourcePath
    • SpecialRegistersArea
    • SplitRing
    • Srb
    • SrbExData
    • SsdtEntry
    • SsdtTable
    • StackFrame
    • StateHistoryEntry
    • Stop
    • StorAdapter
    • StorAdapterEntry
    • StorDriver
    • StorDrivers
    • StorEnumValue
    • StorGateway
    • StorLog
    • StorLogEntry
    • StorQueue
    • StorRequest
    • StorUnit
    • StorUnitEntry
    • SubsectionDetail
    • SummaryRow
    • Symbol
    • SymbolCandidate
    • SymbolPath
    • SymbolSearchMatch
    • SystemMemorySummary
    • SystemPteRun
    • SystemPtesDetail
    • SystemPteTypeDetail
    • TaggedBlock
    • TargetDump
    • TargetKernel
    • TargetTime
    • TargetUserDump
    • TargetVersion
    • Teb
    • Teb32
    • ThreadDetail
    • ThreadInfo
    • ThreadStack
    • ThreadStacks
    • ThreadTime
    • ThreadTimes
    • TimerBucketEnd
    • TimerTable
    • TimerTableEntry
    • Token
    • TokenPrivilege
    • TransitionExtension
    • TriageCrashInfo
    • TriagePrcbInfo
    • TriageReport
    • TrustletInfo
    • UniqStackGroup
    • UniqStacks
    • UniqStackScope
    • UnloadedDriver
    • UnloadedModule
    • UnwalkedThread
    • UnwindHandler
    • UserAddressReport
    • UserDumpTime
    • UserDumpTriage
    • UserException
    • UserExceptionDetail
    • UserExceptionFinding
    • UserFrame
    • UserHandle
    • UserProcessInfo
    • UserProcessSummary
    • UserRegion
    • UserStackThread
    • UserThreadInfo
    • UserThreadTimes
    • VcpuInfo
    • Verifier
    • VerifierAddress
    • VerifierArgument
    • VerifierDriver
    • VerifierDriverSummary
    • VerifierFinding
    • VerifierStatistics
    • VerifierSuspectDriver
    • VirtioBuffer
    • VirtioDescriptor
    • VirtioDriver
    • VirtioFunction
    • VirtioRing
    • VirtQueue
    • VmCounter
    • VmDetail
    • VmPoolDetail
    • VmPteDetail
    • VpbDetail
    • VpRegisters
    • VsChunk
    • VsSubsegment
    • VtopDetail
    • WdfCallback
    • WdfClient
    • WdfContext
    • WdfDeviceDetail
    • WdfDriverDevice
    • WdfDriverInfo
    • WdfDumpDriver
    • WdfEnumValue
    • WdfIoParameters
    • WdfIoTargetDetail
    • WdfIoTargetSummary
    • WdfIrpLocation
    • WdfLoader
    • WdfLogDump
    • WdfLogEntry
    • WdfObject
    • WdfObjectDetail
    • WdfObjectRef
    • WdfQueueDetail
    • WdfQueueSummary
    • WdfRequestDetail
    • WdfRequestIrp
    • WdfRequestRef
    • WdfTargetRequest
    • WdfVersion
    • WheaFinding
    • WheaRecord
    • WheaRecordState
    • WheaSection
    • WinlogonBlackbox
    • WorkerThread
    • WorkItem
    • WorkQueue
    • WorkQueuePriority
    • WorkQueues
    • ZombieKinds
    • ZombieProcess
    • Zombies
    • ZombieThread

Reference

  • Commands
    • Execution and stack
    • Breakpoints and events
    • Memory and disassembly
    • Symbols, types, and expressions
    • Processes and modules
    • User mode
    • CPU
    • Memory manager
    • Objects and I/O
    • Security
    • Analysis
    • Target control
    • Session
  • Expressions

Internals

  • How the code fits together
  • Reading memory over KD
  • Rust crate API (docs.rs)

Resources

  • Changelog
  • Source code
  • Releases
  • Bug reports
  • Discussions
  • PyPI package
  • crates.io
Back to top
View this page
Edit this page

PowerActionDetail¶

final class ntoseye.PowerActionDetail¶

Subclass of BaseRecord.

!poaction: the power action, the power IRPs, and the IRP worker threads.

property irps: Diagnostic[PowerIrpList]¶

The power IRPs on nt!PopIrpList.

property record: PowerAction¶
property workers: Diagnostic[PowerWorkerList]¶

The IRP worker threads on nt!PopIrpThreadList.

Next
PowerButton
Previous
PowerAction
Copyright © dmaivel
Made with Sphinx and @pradyunsg's Furo
On this page
  • PowerActionDetail
    • PowerActionDetail
      • PowerActionDetail.irps
      • PowerActionDetail.record
      • PowerActionDetail.workers