Stop

class ntoseye.Stop

Subclass of BaseRecord.

Why the target stopped, with the context it stopped in, snapshotted at the stop. Each kind is a subclass with that kind’s own parts: Stop.Breakpoint (breakpoint), Stop.Exception (exception), Stop.ModuleLoad and Stop.ModuleUnload (module), Stop.Bugcheck (bugcheck), Stop.Reload (reload), Stop.Step, Stop.Interrupt and Stop.Entry; isinstance and match tell them apart, as kind does.

The parts are records, not live handles; the collections take them as keys: dbg.threads[stop.thread], dbg.processes[stop.process], dbg.modules[stop.module]; dbg.cpus[stop.cpu] is the processor.

property cpu: int | None

The zero-based number of the processor that stopped, as dbg.cpus numbers them in the current view; None on a user-mode minidump, whose threads are no processors.

hit(bp: Breakpoint) → bool

Whether breakpoint bp is the one that stopped the target. bp may be deleted since (a one-shot breakpoint that fired); a later breakpoint that reuses its id, or another debugger’s, is not it.

property inspection_process: ProcessInfo | None

The .process inspection scope at the stop, which can differ from process.

property kind: Literal['breakpoint', 'exception', 'interrupt', 'step', 'module_load', 'module_unload', 'bugcheck', 'reload', 'entry']

The kind of stop, in snake case.

property partition: int | None

The hypervisor partition whose view (.partition) shows the stop.

property process: ProcessInfo | None

The process whose page tables the stopped vCPU has loaded (its CR3).

property rip: int | None

Where it stopped. A bugcheck’s fault site is in bugcheck, a breakpoint’s address in breakpoint, an exception’s in exception.

property symbol: str | None

The nearest symbol to rip, named in the stopped vCPU’s own address space.

property thread: ThreadInfo | None

The Windows thread the stopped vCPU runs.

property vtl: int | None

The VTL the stopped vCPU runs in (1: the secure kernel); None for a user dump.

final class Breakpoint

Subclass of Stop.

A breakpoint or watchpoint hit.

property breakpoint: BreakpointHit

property kind: Literal['breakpoint']

breakpoint.

final class Bugcheck

Subclass of Stop.

The guest is in a bugcheck. bugcheck is the code and parameters when the transport decoded them (None otherwise); dbg.inspect.bugcheck() reads and analyzes the bugcheck from guest memory (!analyze).

property bugcheck: BugcheckInfo | None

property kind: Literal['bugcheck']

bugcheck.

final class Entry

Subclass of Stop.

Nothing stopped the target since the debugger attached: it was found halted (a dump, a target attached halted).

property kind: Literal['entry']

entry.

final class Exception

Subclass of Stop.

A Windows exception.

property exception: ExceptionStop

property kind: Literal['exception']

exception.

final class Interrupt

Subclass of Stop.

A requested break-in, or a stop with no exception code.

property kind: Literal['interrupt']

interrupt.

final class ModuleLoad

Subclass of Stop.

A kernel image loaded, and a ld filter set to break names it (dbg.exceptions.set_module_event("ld", ...), sxe ld). The module is listed with its symbols and breakpoints, and its entry point has not run.

property kind: Literal['module_load']

module_load.

property module: ModuleInfo

final class ModuleUnload

Subclass of Stop.

A kernel image is unloading, and a ud filter set to break names it (sxe ud). Its unload routine has run, and it is still listed.

property kind: Literal['module_unload']

module_unload.

property module: ModuleInfo

final class Reload

Subclass of Stop.

The guest rebooted and the debugger rebuilt its state; earlier handles are stale.

property kind: Literal['reload']

reload.

property reload: ReloadStop

final class Step

Subclass of Stop.

A completed step, or a run to an address that reached it.

property kind: Literal['step']

step.