Thread

final class ntoseye.Thread

One Windows thread. The ETHREAD address is its identity within a debugger.

apcs() → Record

Decode this thread’s APC lists (!apc).

backtrace(limit: int = 64) → list[Frame]

Recover this thread’s stack from live registers or its parked context.

property cpu: Cpu | None

The processor the thread is running on, or None when it is not running.

property ethread: int

The _ETHREAD address: the thread’s identity.

inspect() → Record

Thread summary and saved scheduling details (!thread).

property kthread: int

The _KTHREAD address.

last_error() → Record

Decode the thread’s Win32 last-error and NTSTATUS values (!gle).

property object: Struct

The typed _ETHREAD object.

property pid: int | None

The owning process’s id.

property process: Process | None

The owning process.

property state: int | None

The scheduler state, a _KTHREAD_STATE member (IntEnum).

property teb: Struct | None

The process-bound _TEB, or None for kernel threads.

property tid: int | None

The thread id (None for a thread that has none, like idle threads).

to_dict() → dict[str, Any]

The thread as a plain dict, the shape MCP renders.

trap_frame() → Record

Decode the saved _KTRAP_FRAME (!trap).

property wait_reason: int | None

Why the thread waits, a _KWAIT_REASON member (IntEnum).