UserDump

final class ntoseye.UserDump

A user-mode minidump (dbg.user_dump): the captured process, its threads, the exception the dump was written for, and the handle, memory-region, and unloaded-module records the dump holds. The system it ran on and when it was written are dbg.inspect.version() and dbg.inspect.time().

address_report(address: int | str | Process | Thread | Module | Driver | Device | Heap | None = None) → UserAddressReport

What a user-mode minidump’s memory-info list records (!address): with address, the region that holds it and whether the dump captured it; without, every region with the dump’s summary. A dump without a memory-info list reports the memory ranges it captured instead.

property current_thread: UserThread | None

The thread selected for inspection, which a debugger opens on the exception’s thread when the dump records an exception.

property exception: UserExceptionDetail | None

The exception the dump was written for, or None when it records none.

exception_context() → Frame

The registers at the exception (.ecxr), from the CONTEXT the dump stores beside the exception record, as a read-only Frame. Raises NtoseyeError when the dump records no exception or its context is unusable.

property exception_thread: UserThread | None

The thread that raised the dump’s exception, or None when the dump records no exception (or its thread is not in the thread list).

property handles: list[UserHandle] | None

The handles the process held, as the dump records them, or None when the dump has no handle data.

property notes: list[str]

What ntoseye dropped or cut short while reading the dump, and why.

property process: UserProcess

The captured process.

region(address: int | str | Process | Thread | Module | Driver | Device | Heap) → UserRegion | None

The region holding address, or None when no region holds it or the dump has no memory-info list.

property regions: list[UserRegion] | None

The regions of the process’s address space, by base, each with what uses it (!address), or None when the dump has no memory-info list. A region’s bytes read only where the dump captured them.

property threads: UserThreads

The captured threads, by thread id: threads[tid], iteration in the dump’s order.

property unloaded_modules: list[UnloadedModule]

The modules the process had unloaded.