VtopDetail

final class ntoseye.VtopDetail

Subclass of BaseRecord.

A virtual address translated through the page tables of a DTB (!vtop), with every level read.

property address: int

property dtb: int

property large: bool

Whether a large page maps it.

property levels: list[PteLevel]

The levels read, top down.

property physical: int | None

The physical address; None when the address is not mapped.

property physical_walk: bool

Whether the levels’ addresses are physical (a walk of the tables from the DTB) rather than virtual through NT’s self-map.

property section: bool

Whether nothing maps the page here. If true, physical is the frame that the page’s section PTE holds, for a page of a shared image or file view that is not touched yet. It cannot be written either.

property transition: bool

Whether the leaf is a transition PTE. If true, physical is a frame that the guest still holds, but nothing maps it here and it cannot be written.