Symbols

final class ntoseye.Symbols

Symbol lookup in one address space (dbg.symbols, proc.symbols).

__contains__(name: str, /) → bool

True if one or more symbol candidates have this name.

__getitem__(name: str, /) → int

Get the address of a symbol, or raise SymbolNotFoundError if the symbol is not found.

candidates(name: str) → list[SymbolCandidate]

Get all exact candidates, with the module and, for private symbols, the compiland.

get(name: str) → int | None

Get the address of a symbol, or None if the symbol is not found.

import_image(path: str) → str

Copy a PE file into the symbol cache under the key in its own header, and return its path in the cache (.fetchimage /f). Use it for an image that no symbol server has, such as the Windows hypervisor’s hvix64.exe.

locals_at(address: int | str | Process | Thread | Module | Driver | Device | Heap) → list[ProcedureLocal]

List the PDB layouts of the locals and parameters of the innermost frame at address, which are those of the inlined call if the compiler inlined a call there. This method does not evaluate the values.

nearest(address: int | str | Process | Thread | Module | Driver | Device | Heap) → Symbol | None

List the symbol nearest to an address.

property path: list[str]

The ordered symbol sources (.sympath). An assignment replaces the full path.

reload(*, scope: Literal['current', 'kernel', 'user'] | None = None, module: str | None = None) → ModuleSymbolLoadReport

Reload symbols for the modules in the current scope, or for the modules a name or pattern names.

Asks the symbol path again for each module’s PDB, whatever failed before, and loads it at once. The current scope’s modules are the selected process’s user-mode modules, else the kernel’s; /n reloads the kernel’s and /user the selected process’s. A module is a name such as nt or viostor.sys, or a pattern with * and ? such as vio*. /f and /v are accepted as in WinDbg: ntoseye always loads at once, and lm shows each module’s symbol status.

reset_path() → SymbolPath

Set the symbol source path back to the defaults, the ntoseye cache and the Microsoft symbol server.

search(query: str, *, limit: int = 50) → list[SymbolSearchMatch]

Search symbol names by fuzzy match. Use module!query to search in one module.

source_addresses(file: str, line: int) → list[int]

Get all loaded addresses that match a source file and line.

source_location(address: int | str | Process | Thread | Module | Driver | Device | Heap) → SourceLocation | None

Get the PDB source metadata and the mapped local path for an address.

property source_path: list[str]

The ordered source-path mappings (.srcpath). An assignment replaces all of them.