Thread

final class ntoseye.Thread

One Windows thread, identified in a debugger by its ETHREAD address.

apcs() → ApcQueues

Decode the APC lists of this thread (!apc).

backtrace(*, limit: int = 64) → list[Frame]

Recover the stack of this thread from live registers or its parked context. If the processor of the thread is halted in the Windows hypervisor, the unwind starts from the VTL0 state that the hypervisor saved, where NT stopped.

property base_priority: int | None

property cpu: Cpu | None

The processor that runs the thread, or None if the thread is not running.

decode_teb(address: int | str | Process | Thread | Module | Driver | Device | Heap | None = None) → Teb

Decode a thread environment block.

If you do not give an address, the command uses the teb pseudo-register of the current thread. On a user-mode minidump it uses the TEB of the selected thread (~s), and the layouts of the dump’s ntdll.

property eprocess: int | None

The owning _EPROCESS.

property ethread: int

The _ETHREAD address, which identifies the thread.

property info: ThreadInfo

The ThreadInfo record of this handle: its properties as one value.

inspect() → ThreadDetail

Show a Windows thread and, optionally, its kernel stack.

You can also use the legacy thread <tid> k|r [count] forms. A numeric flags value selects the detail and stack output, and count sets the maximum number of stack frames (32 by default, or 16 for k). The command shows - for a field that is not available. If the vCPU of a running thread is halted in the Windows hypervisor (VBS), the command shows the thread from the VTL0 state that the hypervisor saved, and .thread selects the thread in the same way. While the target runs, the command shows the thread but does not select it, and a thread that runs on a processor has no stack.

property kernel_stack: int | None

_KTHREAD.KernelStack, the saved stack pointer of a thread that is not running.

property kernel_stack_resident: bool | None

property kthread: int

The _KTHREAD address.

last_error() → LastError

Show the last Win32 error value and the last NT status value of the current thread.

property object: Struct

The typed _ETHREAD object.

property pending_irps: list[int] | None

The IRPs on the thread’s IrpList.

property pid: int | None

The ID of the process that owns the thread.

property priority: int | None

The current scheduling priority.

property process: Process | None

The process that owns the thread.

property process_name: str | None

The image name of the owning process.

property stack_base: int | None

property stack_limit: int | None

property start_address: int | None

property state: int | None

The scheduler state, as a _KTHREAD_STATE member (IntEnum).

property state_name: str | None

The name of the state (Running, Waiting, …).

property teb: Struct | None

The _TEB, bound to the process, or None for kernel threads.

property tid: int | None

The thread ID, or None if the thread has no ID (for example, an idle thread).

to_dict() → dict[str, Any]

The record (info) as a plain dict.

trap_frame() → KtrapFrame

Decode the saved _KTRAP_FRAME (!trap).

property wait_irql: int | None

property wait_reason: int | None

The reason the thread waits, as a _KWAIT_REASON member (IntEnum).

property wait_reason_name: str | None

The name of the wait reason (Executive, UserRequest, …).

property win32_start_address: int | None