Skip to content

Getting started

Install
Quickstart
Your first session
Coming from WinDbg
Troubleshooting
Command line

Setting up a target

Choosing a backend
KVM/QEMU
VMware Workstation
UTM (macOS, Apple Silicon)
KDNET

Using ntoseye

Using the REPL
Breakpoints and watchpoints
Memory and paging
Symbols and source
Bugchecks
Crash dumps
Driver replacement map (.kdfiles)
KMDF drivers (!wdfkd)
Virtio devices (!virtio, !vring)
StorPort adapters (!storagekd.*)
Network miniports (!ndiskd.*)
The registry (!reg)
Developing drivers from a Linux host

Platform topics

WOW64 processes

VBS and the Windows hypervisor

Overview
Debugging a Windows Sandbox
The secure kernel (VTL1)
Partitions and virtual processors
Guest partitions
Hypercalls and VM exits
Stops in the Windows hypervisor
VBS internals

Integrations

Editor integration (DAP)
Disassembler integration (GDB remote protocol)
MCP integration

Scripting

Python SDK
Custom REPL commands
Python API

Reference

Commands
Expressions

Internals

How the code fits together
Reading memory over KD
Rust crate API (docs.rs)

Resources

Changelog
Source code
Releases
Bug reports
Discussions
PyPI package
crates.io

WinlogonBlackbox¶

final class ntoseye.WinlogonBlackbox¶

Subclass of BaseRecord.

What winlogon was doing.

property is_operation_pending: int¶

property thread_name: str¶

Copyright © dmaivel

Made with Sphinx and @pradyunsg's Furo

On this page

WinlogonBlackbox
- WinlogonBlackbox
  - WinlogonBlackbox.is_operation_pending
  - WinlogonBlackbox.thread_name