SecureKernel

final class ntoseye.SecureKernel

The secure kernel (securekernel.exe) that runs in VTL1. Its views use its system address space and are read-only, so writes raise NtoseyeError.

property base: int

The base address of securekernel.exe.

property dtb: int

The secure kernel’s system page-table root.

eval(expr: str) → int

Evaluate a debugger (MASM) expression to an integer (?) in this object’s scope: the debugger’s is the kernel’s, with the registers of the stopped vCPU (on a user-mode minidump, of the selected thread); a process’s resolves the symbols of its modules, which it loads first; a VTL1 address space’s (the secure kernel’s, a trustlet’s) has no registers, as the live ones hold VTL0 state.

property memory: Memory

Virtual memory, read through the system page tables of the secure kernel.

property modules: Modules

The modules that the secure kernel loaded (securekernel.exe, skci.dll, …).

property symbols: Symbols

The symbols of the secure kernel’s modules (securekernel!...). NT symbols do not resolve here.

property trustlets: list[Trustlet]

The processes (trustlets) of the secure kernel. Each access walks the list again and validates it against the NT process list. Raises NtoseyeError if ntoseye does not recognize the process layout of this build.

property types: Types

PDB types, read through VTL1 memory. The public secure-kernel PDB has no types, so give NT types with their module name (nt!_LIST_ENTRY).