Trustlet

final class ntoseye.Trustlet

An isolated user-mode process (trustlet) in VTL1, such as LsaIso.exe. Its read-only views go through the page tables of the trustlet, which map the user half of the trustlet and the secure kernel.

property address: int

The address of the secure kernel’s process object for this trustlet.

property dtb: int

The trustlet’s page-table root.

eval(expr: str) → int

Evaluate a debugger (MASM) expression to an integer (?) in this object’s scope: the debugger’s is the kernel’s, with the registers of the stopped vCPU (on a user-mode minidump, of the selected thread); a process’s resolves the symbols of its modules, which it loads first; a VTL1 address space’s (the secure kernel’s, a trustlet’s) has no registers, as the live ones hold VTL0 state.

property info: TrustletInfo

The TrustletInfo record of this handle: its properties as one value.

property memory: Memory

Virtual memory, read through the page tables of the trustlet.

property name: str

The image name, from the NT process.

property pid: int

The NT process ID of the trustlet’s VTL0 counterpart.

property process: Process | None

The NT process (VTL0 side), or None after the process exits.

property symbols: Symbols

The symbols of the secure kernel, resolved in the address space of this trustlet. The user-mode modules of the trustlet are not included.

to_dict() → dict[str, Any]

The record (info) as a plain dict.

property trustlet_id: int

The trustlet ID from its creation attributes (1 for LsaIso.exe).

property types: Types

PDB types, read through the memory of the trustlet (nt! types by name).