ProcessInfo

final class ntoseye.ProcessInfo

Subclass of BaseRecord.

The identity of a process (ps, !process 0 0) and the root (dtb) of its address space.

property dtb: int

The directory table base (page-table root).

property eprocess: int

The _EPROCESS address.

property name: str

The image name.

property pid: int

The process identifier.

property wow64: bool

True if it is a 32-bit process that runs under WOW64.

property wow64_peb: int | None

The 32-bit PEB of a WOW64 process (_EPROCESS.WoW64Process), None for a native process.