Process¶

final class ntoseye.Process¶

One process, with identity fields and views bound to its address space.

apcs() → ApcQueues¶: Decode the kernel and user APC queues of this process (!apc).

critical_section(address: int | str | Process | Thread | Module | Driver | Device | Heap) → CriticalSection¶: Decode a critical section (!cs address).

critical_sections() → CriticalSections¶: List the critical sections of the process (!cs).

Decode the process environment block and process parameters of the current process.

If you do not give an address, the command uses EPROCESS.Peb of the current process: the one that .process selected, else the owner of the current thread. On a user-mode minidump it uses the PEB that the selected thread’s TEB names, and the layouts of the dump’s ntdll. It decodes the process parameters with their PDB layouts. To list the loader modules, use !dlls.

property dtb: int¶: The directory table base (page-table root).

property eprocess: int¶: The _EPROCESS address.

eval(expr: str) → int¶: Evaluate a debugger (MASM) expression to an integer (?) in this object’s scope: the debugger’s is the kernel’s, with the registers of the stopped vCPU (on a user-mode minidump, of the selected thread); a process’s resolves the symbols of its modules, which it loads first; a VTL1 address space’s (the secure kernel’s, a trustlet’s) has no registers, as the live ones hold VTL0 state.

handle(value: int) → HandleEntry¶: Decode a handle in the handle table of this process.

handle_traces(handle: int | None = None, *, max_traces: int | None = None) → HandleTraces¶

Show the stacks that handle tracing recorded for the handles of a process.

Reads the ring of traces (open, close, bad reference) in the DebugInfo of the process handle table and shows the newest trace first. If handle is 0 or not given, the command shows the traces of all handles, and if max-traces is 0 or not given, it shows all traces. The process can be an EPROCESS address, a PID, or a name, and the default is the current process. Handle tracing must be on for the process before you use the command. The Handles check of Application Verifier or NtSetInformationProcess(ProcessHandleTracing) turns tracing on, and if it is off, !htrace shows a message. User-mode frames resolve after the modules of the process are loaded (.process /p). The command does not have the user-mode forms that change tracing (-enable, -disable, -snapshot, -diff).

handles(*, limit: int = 256) → HandleTable¶: List a maximum of limit handles in the handle table of this process.

property heaps: Heaps¶: The heaps of this process.

property info: ProcessInfo¶: The ProcessInfo record of this handle: its properties as one value.

inspect() → ProcessDetail¶

List or inspect Windows processes.

!process 0 0 lists all processes. Bit 1 adds process details, bit 2 adds threads, and bit 4 adds the stack of each thread. An image name in place of the process shows every process whose name contains it or matches it as a glob, as the last argument filters: !process explorer.exe shows explorer.exe, and !process svchost 0 lists each svchost.exe. ps keeps its short legacy list format.

List the modules in the loader lists of the current process.

The current process is the one that .process selected, else the owner of the current thread; on a user-mode minidump, its one process, as far as the dump captured the loader’s lists (lm lists the dump’s own module list). With -c

, the command shows only the module that contains that address. The module walk has a limit, and also stops if it finds a cycle in a list.

property memory: Memory¶: The virtual memory, through the page tables of this process.

property modules: Modules¶: The modules from the PEB loader lists of this process.

property name: str¶: The image name.

property object: Struct¶: The process _EPROCESS cursor.

property peb: Struct | None¶: The process _PEB cursor, or None if the process has no PEB.

property pid: int¶: The process identifier.

property ppid: int¶: The parent process identifier.

Show the VirtualQuery data for a user address.

The command shows the region, state, protection, and type of a user address, as VirtualQuery reports them. It looks up the address in the current process context, which you can select with .process /p <pid>. The VAD that holds the address gives AllocationBase, AllocationProtect, and Type, and the state and protection of each page come from its PTE. For a page without a PTE, they come from the VAD (private memory) or from its prototype PTE (a section view). RegionSize runs from the page of the address to the first page that differs. An address that is not in a VAD is MEM_FREE up to the next VAD. The scan stops after 262,144 page-table steps. On a user-mode minidump the command reads the region from the dump’s memory-info list, which records what VirtualQuery returned when the dump was written; RegionSize runs from the page of the address to the end of that region.

property regions: Regions¶: The process VAD regions (!vad / vmmap).

property session: int | None¶: The Windows session identifier.

property symbols: Symbols¶: The symbols, resolved in the address space of this process.

thread_times() → ThreadTimes¶

Show how much processor time each thread of the current process has used.

The flags choose what to show, each as a list of the threads by that time, most first: 1 the user-mode time (the default), 2 the kernel-mode time, 4 the time since each thread started, so 7 shows all three. The current process is the one that .process selected, else the owner of the current thread; on a user-mode minidump, its one process, whose thread-info stream records the times. A kernel target counts them in clock ticks, so they are as precise as one tick (15.6 ms by default).

property threads: Threads¶: The Windows threads that this process owns.

to_dict() → dict[str, Any]¶: The record (info) as a plain dict.

token() → Token¶

Show the primary token of the selected or current process.

The command shows the token IDs, user and groups, privileges, type, impersonation level, and flags. It gets each field independently, and if the metadata or memory for a field is missing, it shows this in that field.

property types: Types¶: The PDB types and cursors, bound to the address space of this process.

property wow64: bool¶: True if it is a 32-bit process that runs under WOW64.

property wow64_peb: int | None¶: The 32-bit PEB of a WOW64 process (_EPROCESS.WoW64Process), None for a native process.

write_minidump(path: str) → MinidumpWrite¶: Write a user-mode minidump of the process (.dump /u): its threads with their user-mode registers, its modules, its regions, and its memory that is in physical memory.