Trustlet

final class ntoseye.Trustlet

An isolated user-mode process (trustlet) in VTL1, such as LsaIso.exe. Its views read through the trustlet’s own page tables, which map its user half and the secure kernel. Read-only.

property address: int

Address of the secure kernel’s process object for this trustlet.

property dtb: int

The trustlet’s page-table root.

eval(expr: str) → int

Evaluate a debugger expression in this trustlet’s address space.

property memory: Memory

Virtual memory through the trustlet’s page tables.

property name: str

The image name, from the NT process.

property pid: int

The NT process ID of the trustlet’s VTL0 counterpart.

property process: Process | None

The NT process (VTL0 side), or None once it has exited.

property symbols: Symbols

The secure kernel’s symbols, resolved in this trustlet’s address space. The trustlet’s own user-mode modules are not enumerated.

to_dict() → dict[str, Any]

The trustlet’s identity as a plain dict (pid, name, trustlet_id, dtb, address), the shape !trustlets lists.

property trustlet_id: int

The trustlet ID from its creation attributes (1 for LsaIso.exe).

property types: Types

PDB types read through the trustlet’s memory (nt! types by name).