UserThread

final class ntoseye.UserThread

One thread a user-mode minidump captured, identified by its thread id. Its registers are the context the dump recorded for it; nothing about it can be changed.

backtrace(*, limit: int = 64) → list[Frame]

Recover the thread’s stack from its recorded registers.

property context_error: str | None

Why the thread’s recorded context is unusable, or None when it is usable.

decode_teb(address: int | str | Process | Thread | Module | Driver | Device | Heap | None = None) → Teb

Decode a thread environment block.

If you do not give an address, the command uses the teb pseudo-register of the current thread. On a user-mode minidump it uses the TEB of the selected thread (~s), and the layouts of the dump’s ntdll.

property exception: bool

Whether this thread raised the exception the dump was written for.

property index: int

The thread’s position in the dump’s thread list, which ~N names.

property info: UserThreadInfo

The UserThreadInfo record of this handle: its properties as one value.

last_error() → LastError

Show the last Win32 error value and the last NT status value of the current thread.

property name: str | None

The thread’s description (SetThreadDescription), when the dump records one.

property priority: int

property priority_class: int

property registers: Registers

The registers the dump recorded for the thread, read-only. Reading one raises NtoseyeError when the thread’s context is unusable.

property stack: CapturedStack | None

The captured stack, None when the dump holds none of it.

property suspend_count: int

property teb: Struct | None

The ntdll!_TEB cursor, or None when the dump records no TEB.

property tid: int

The thread id.

property times: UserThreadTimes | None

What the dump’s thread-info stream records of the thread, when it has one.

to_dict() → dict[str, Any]

The record (info) as a plain dict.