Stop

class ntoseye.Stop

Why the target stopped. Every stop is one of the nested kinds; test with isinstance(stop, Stop.Breakpoint) or match. A stop is bound to the target generation it happened in.

property breakpoints: list[Breakpoint]

Breakpoint or watchpoint handles for this stop; empty on other kinds, so bp in stop.breakpoints works on any stop.

property cpu: Cpu

Processor that stopped.

property process: Process | None

Process whose page tables were active at this stop, if known.

record() → Record

Decode the current exception record (.exr -1).

property rip: int | None

Instruction pointer captured at this stop.

property symbol: str | None

Nearest symbol captured at this stop, if one resolved.

property thread: Thread | None

Windows thread executing on the stopped vCPU, if known.

to_dict() → dict[str, Any]

final class Breakpoint

Subclass of Stop.

A code breakpoint or data-watchpoint hit. condition_error is set when its condition failed to evaluate; such a hit is surfaced, not skipped.

property condition_error: str | None

Why the breakpoint’s condition failed to evaluate, if it did.

final class Bugcheck

Subclass of Stop.

The guest is bugchecking (BSOD); info is the bugcheck analysis.

property info: Record | None

The bugcheck analysis (!analyze’s code, parameters, and culprit).

final class Exception

Subclass of Stop.

A Windows exception: code (NTSTATUS), whether it is the first chance, and the faulting address.

property address: int | None

The faulting address, when the exception carries one.

property code: int

The exception’s NTSTATUS code.

property first_chance: bool | None

Whether this is the first chance (None when the backend does not say).

final class Interrupt

Subclass of Stop.

A break-in (interrupt()), or another stop without an exception code.

final class Reboot

Subclass of Stop.

The guest rebooted; every earlier handle is now stale. While coherent is false the kernel’s module list does not exist yet: kernel symbols and breakpoints work, and run() lets boot continue.

property coherent: bool

Whether the kernel’s module list exists yet.

property kernel_base: int | None

The new kernel’s base address (moved by KASLR).

final class Step

Subclass of Stop.

A completed step.