TrustletInfo

final class ntoseye.TrustletInfo

Subclass of BaseRecord.

An isolated user-mode process (trustlet) in VTL1, such as LsaIso.exe, as !trustlets lists it.

property address: int

The address of the secure kernel’s process object for this trustlet.

property dtb: int

The trustlet’s page-table root.

property name: str

The image name, from the NT process.

property pid: int

The NT process ID of the trustlet’s VTL0 counterpart.

property trustlet_id: int

The trustlet ID from its creation attributes (1 for LsaIso.exe).