Process

final class ntoseye.Process

One process: identity fields plus views bound to its address space.

apcs() → Record

Decode kernel and user APC queues for this process (!apc).

property dtb: int

The process page-table root.

property eprocess: int

The _EPROCESS virtual address.

eval(expr: str) → int

Evaluate a debugger expression in this process’s symbol scope.

handle(value: int) → Record

Decode a handle in this process’s handle table.

handles(limit: int = 256) → Record

Enumerate up to limit handles in this process’s handle table.

property heaps: Heaps

The heaps in this process’s PEB.

property memory: Memory

Virtual memory through this process’s page tables.

property modules: Modules

Modules from this process’s PEB loader lists.

property name: str

The image name.

property object: Struct

The process _EPROCESS cursor.

property peb: Struct | None

The process _PEB cursor, or None when it has no PEB.

property pid: int

The process identifier.

property ppid: int

The parent process identifier.

property regions: Regions

The process VAD regions (!vad / vmmap).

property session: int | None

The Windows session identifier.

property symbols: Symbols

Symbols resolved in this process’s address space.

property threads: Threads

Windows threads owned by this process.

to_dict() → dict[str, Any]

The process’s identity as a plain dict (pid, name, dtb, eprocess, wow64), the shape MCP renders.

token() → Record

The process token and its security information.

property types: Types

PDB types and cursors bound to this process’s address space.

property wow64: bool

Whether this process has a WOW64 (32-bit) PEB.