UserProcess

final class ntoseye.UserProcess

The process a user-mode minidump captured (dbg.user_dump.process). It is the only one, so it has no EPROCESS or page-table root; memory, modules, and threads are the dump’s.

critical_section(address: int | str | Process | Thread | Module | Driver | Device | Heap) → CriticalSection

Decode a critical section (!cs address).

critical_sections() → CriticalSections

List the critical sections of the process (!cs).

decode_peb(address: int | str | Process | Thread | Module | Driver | Device | Heap | None = None) → Peb

Decode the process environment block and process parameters of the current process.

If you do not give an address, the command uses EPROCESS.Peb of the current process: the one that .process selected, else the owner of the current thread. On a user-mode minidump it uses the PEB that the selected thread’s TEB names, and the layouts of the dump’s ntdll. It decodes the process parameters with their PDB layouts. To list the loader modules, use !dlls.

property info: UserProcessInfo

The UserProcessInfo record of this handle: its properties as one value.

loader_modules(*, containing: int | str | Process | Thread | Module | Driver | Device | Heap | None = None) → LoaderModules

List the modules in the loader lists of the current process.

The current process is the one that .process selected, else the owner of the current thread; on a user-mode minidump, its one process, as far as the dump captured the loader’s lists (lm lists the dump’s own module list). With -c

, the command shows only the module that contains that address. The module walk has a limit, and also stops if it finds a cycle in a list.

property memory: Memory

The process’s memory: every captured range, by virtual address.

property modules: Modules

The modules the dump lists.

property name: str | None

The executable’s file name, from the first module the dump lists.

property peb: Struct | None

The ntdll!_PEB cursor, found through the selected thread’s TEB, or None when the dump holds neither.

property pid: int | None

The process id, when the dump records it.

thread_times() → ThreadTimes

Show how much processor time each thread of the current process has used.

The flags choose what to show, each as a list of the threads by that time, most first: 1 the user-mode time (the default), 2 the kernel-mode time, 4 the time since each thread started, so 7 shows all three. The current process is the one that .process selected, else the owner of the current thread; on a user-mode minidump, its one process, whose thread-info stream records the times. A kernel target counts them in clock ticks, so they are as precise as one tick (15.6 ms by default).

property threads: UserThreads

The captured threads.

to_dict() → dict[str, Any]

The record (info) as a plain dict.