Skip to main content

Libvmi Python bindings

Join the chat at https://gitter.im/libvmi/python CI

If you'd rather perform introspection using Python instead of C, then these bindings will help get you going.

The bindings are Python 2 compatible.

Requirements

  • python3-pkgconfig
  • python3-cffi (> 1.6.0)
  • python3-future
  • libvmi

Setup

python setup.py build
python setup.py install

API

Constructor

The main class that you need to import is Libvmi.

The default parameters uses VMI_CONFIG_GLOBAL_FILE_ENTRY and calls vmi_init_complete:

from libvmi import Libvmi

with Libvmi("Windows_7") as vmi:
    os = vmi.get_ostype()

You can specify a string (VMI_CONFIG_STRING):

from libvmi import Libvmi, VMIConfig

config_str = '{ostype = "Windows";win_pdbase=0x28;win_pid=0x180;win_tasks=0x188;win_pname=0x2e0;}'

with Libvmi("Windows_7", mode=VMIConfig.STRING, config=config_str) as vmi:
    os = vmi.get_ostype()

Or a dict (VMI_CONFIG_GHASHTABLE):

from libvmi import Libvmi, VMIConfig

hash = {
    "ostype": "Windows",
    "win_pdbase": 0x28,
    "win_tasks": 0x188,
    "win_pid": 0x180,
    "win_pname": 0x2e0,
}

with Libvmi("Windows_7", mode=VMIConfig.DICT, config=hash) as vmi:
    os = vmi.get_ostype()

You can also use a partial initialization, which calls vmi_init. (It doesn't require a configuration):

from libvmi import Libvmi

with Libvmi("Windows_7", partial=True) as vmi:

Examples

from libvmi import Libvmi, AccessContext, TranslateMechanism

with Libvmi("Windows_7") as vmi:
    pshead = vmi.read_addr_ksym("PsActiveProcessHead")
    name = vmi.get_name()
    id = vmi.get_vmid()
    buffer, bytes_read = vmi.read_va(pshead, 4, 16)
    vmi.write_va(pshead, 4, buffer)
    ctx = AccessContext(TranslateMechanism.KERNEL_SYMBOL, ksym="PsActiveProcessHead")
    buffer, bytes_read = vmi.read(ctx, 8)

Note: The implementation already checks if the return value is VMI_FAILURE and raises a LibvmiError in such case.

Integration

Volatility

You can use the volatlity framework directly in top of the bindings.

git clone https://github.com/volatilityfoundation/volatility /tmp
cp ./volatility/vmi.py /tmp/volatility/volatility/plugins/addrspaces/

Usage

python vol.py -l vmi://domain --profile=Win7SP0x64 pslist

Rekall

The Rekall address space is already integrated upstream.

Usage

rekall -f vmi://domain pslist

Contributors

  • Bryan D. Payne
  • Mathieu Tarral

Release files for libvmi 3.7.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Built distributions (wheels)

Table of built distributions (wheels) for libvmi 3.7.1
File
libvmi-3.7.1-cp311-cp311-manylinux_2_28_x86_64.whl CPython 3.11 CPython 3.11 Linux glibc 2.28+ x86-64 Details
libvmi-3.7.1-cp310-cp310-manylinux_2_28_x86_64.whl CPython 3.10 CPython 3.10 Linux glibc 2.28+ x86-64 Details
libvmi-3.7.1-cp39-cp39-manylinux_2_28_x86_64.whl CPython 3.9 CPython 3.9 Linux glibc 2.28+ x86-64 Details
libvmi-3.7.1-cp38-cp38-manylinux_2_28_x86_64.whl CPython 3.8 CPython 3.8 Linux glibc 2.28+ x86-64 Details
libvmi-3.7.1-cp37-cp37m-manylinux_2_28_x86_64.whl CPython 3.7 CPython 3.7 pymalloc Linux glibc 2.28+ x86-64 Details

Total release size: 4.7 MB

Release files / libvmi-3.7.1-cp311-cp311-manylinux_2_28_x86_64.whl

Download URL libvmi-3.7.1-cp311-cp311-manylinux_2_28_x86_64.whl
Size 946.9 kB
Tags CPython 3.11 Linux glibc 2.28+ x86-64
SHA-256 checksum
How to use checksums
00c4341e7fea70c86524bd9947b5cf2ddd4e8c61d39459deacdef8de61279a13
BLAKE2b-256 checksum
How to use checksums
d8dc718616f2a3c8a943ff1cff891fc3d4ab86c869cb6cbf0059b586aeea87fa
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/5.1.1 CPython/3.9.20

Release files / libvmi-3.7.1-cp310-cp310-manylinux_2_28_x86_64.whl

Download URL libvmi-3.7.1-cp310-cp310-manylinux_2_28_x86_64.whl
Size 946.9 kB
Tags CPython 3.10 Linux glibc 2.28+ x86-64
SHA-256 checksum
How to use checksums
5d197d3f2274392614639e111cd54f56426d0c6c3653409f59725039fa6931d0
BLAKE2b-256 checksum
How to use checksums
06fd79c953f2f05d7a8b394cae0236954568998bb1dc56f11b89059a8e69201f
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/5.1.1 CPython/3.9.20

Release files / libvmi-3.7.1-cp39-cp39-manylinux_2_28_x86_64.whl

Download URL libvmi-3.7.1-cp39-cp39-manylinux_2_28_x86_64.whl
Size 946.9 kB
Tags CPython 3.9 Linux glibc 2.28+ x86-64
SHA-256 checksum
How to use checksums
604630333a21e1c5347463792a883e97ee95bf75df76459d2e360e3545af9412
BLAKE2b-256 checksum
How to use checksums
c986491d6a02434e5d66f4622f5a7bc189e8f41eaaaa8cc45152d9137825e3aa
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/5.1.1 CPython/3.9.20

Release files / libvmi-3.7.1-cp38-cp38-manylinux_2_28_x86_64.whl

Download URL libvmi-3.7.1-cp38-cp38-manylinux_2_28_x86_64.whl
Size 947.1 kB
Tags CPython 3.8 Linux glibc 2.28+ x86-64
SHA-256 checksum
How to use checksums
254188a772fb57584e6bf259aa2256abfa63d0225bfc4246542489f16520d4d7
BLAKE2b-256 checksum
How to use checksums
9a4b5e64dee55585a866e2d2e8d14d72c18d03cc2e7e4c7d9ee796731a2d5212
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/5.1.1 CPython/3.9.20

Release files / libvmi-3.7.1-cp37-cp37m-manylinux_2_28_x86_64.whl

Download URL libvmi-3.7.1-cp37-cp37m-manylinux_2_28_x86_64.whl
Size 946.4 kB
Tags CPython 3.7 CPython 3.7 pymalloc Linux glibc 2.28+ x86-64
SHA-256 checksum
How to use checksums
6039eb2ad65a3fb26367987f73d4f7e1fcbee61d3d99b5521ef60bbbe571ad96
BLAKE2b-256 checksum
How to use checksums
875b96ab29a5279027a7f902a9863776e46a3f3481dcde4370a54084636f36be
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/5.1.1 CPython/3.9.20

Release history Release notifications | RSS feed

This release

3.7.1 This release

5 release files

3.7

5 release files

3.6.2

9 release files

3.4

1 release file

3.3

1 release file

3.2.3

1 release file

3.2.1

1 release file

3.2

1 release file

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page