Libvmi Python bindings
If you'd rather perform introspection using Python instead of C, then these bindings will help get you going.
The bindings are Python 2 compatible.
Requirements
python3-pkgconfigpython3-cffi(> 1.6.0)python3-futurelibvmi
Setup
python setup.py build
python setup.py install
API
Constructor
The main class that you need to import is Libvmi.
The default parameters uses VMI_CONFIG_GLOBAL_FILE_ENTRY and calls vmi_init_complete:
from libvmi import Libvmi
with Libvmi("Windows_7") as vmi:
os = vmi.get_ostype()
You can specify a string (VMI_CONFIG_STRING):
from libvmi import Libvmi, VMIConfig
config_str = '{ostype = "Windows";win_pdbase=0x28;win_pid=0x180;win_tasks=0x188;win_pname=0x2e0;}'
with Libvmi("Windows_7", mode=VMIConfig.STRING, config=config_str) as vmi:
os = vmi.get_ostype()
Or a dict (VMI_CONFIG_GHASHTABLE):
from libvmi import Libvmi, VMIConfig
hash = {
"ostype": "Windows",
"win_pdbase": 0x28,
"win_tasks": 0x188,
"win_pid": 0x180,
"win_pname": 0x2e0,
}
with Libvmi("Windows_7", mode=VMIConfig.DICT, config=hash) as vmi:
os = vmi.get_ostype()
You can also use a partial initialization, which calls vmi_init.
(It doesn't require a configuration):
from libvmi import Libvmi
with Libvmi("Windows_7", partial=True) as vmi:
Examples
from libvmi import Libvmi, AccessContext, TranslateMechanism
with Libvmi("Windows_7") as vmi:
pshead = vmi.read_addr_ksym("PsActiveProcessHead")
name = vmi.get_name()
id = vmi.get_vmid()
buffer, bytes_read = vmi.read_va(pshead, 4, 16)
vmi.write_va(pshead, 4, buffer)
ctx = AccessContext(TranslateMechanism.KERNEL_SYMBOL, ksym="PsActiveProcessHead")
buffer, bytes_read = vmi.read(ctx, 8)
Note: The implementation already checks if the return value is VMI_FAILURE and
raises a LibvmiError in such case.
Integration
Volatility
You can use the
volatlity framework
directly in top of the bindings.
git clone https://github.com/volatilityfoundation/volatility /tmp
cp ./volatility/vmi.py /tmp/volatility/volatility/plugins/addrspaces/
Usage
python vol.py -l vmi://domain --profile=Win7SP0x64 pslist
Rekall
The Rekall address space is already
integrated
upstream.
Usage
rekall -f vmi://domain pslist
Contributors
- Bryan D. Payne
- Mathieu Tarral
Release files for libvmi 3.7.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| libvmi-3.7.1-cp311-cp311-manylinux_2_28_x86_64.whl | CPython 3.11 | CPython 3.11 | Linux glibc 2.28+ x86-64 | Details |
| libvmi-3.7.1-cp310-cp310-manylinux_2_28_x86_64.whl | CPython 3.10 | CPython 3.10 | Linux glibc 2.28+ x86-64 | Details |
| libvmi-3.7.1-cp39-cp39-manylinux_2_28_x86_64.whl | CPython 3.9 | CPython 3.9 | Linux glibc 2.28+ x86-64 | Details |
| libvmi-3.7.1-cp38-cp38-manylinux_2_28_x86_64.whl | CPython 3.8 | CPython 3.8 | Linux glibc 2.28+ x86-64 | Details |
| libvmi-3.7.1-cp37-cp37m-manylinux_2_28_x86_64.whl | CPython 3.7 | CPython 3.7 pymalloc | Linux glibc 2.28+ x86-64 | Details |
Total release size: 4.7 MB
Release files / libvmi-3.7.1-cp311-cp311-manylinux_2_28_x86_64.whl
| Download URL | libvmi-3.7.1-cp311-cp311-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 946.9 kB |
| Tags | CPython 3.11 Linux glibc 2.28+ x86-64 |
|
SHA-256 checksum How to use checksums |
00c4341e7fea70c86524bd9947b5cf2ddd4e8c61d39459deacdef8de61279a13
|
|
BLAKE2b-256 checksum How to use checksums |
d8dc718616f2a3c8a943ff1cff891fc3d4ab86c869cb6cbf0059b586aeea87fa
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.1 CPython/3.9.20
|
Release files / libvmi-3.7.1-cp310-cp310-manylinux_2_28_x86_64.whl
| Download URL | libvmi-3.7.1-cp310-cp310-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 946.9 kB |
| Tags | CPython 3.10 Linux glibc 2.28+ x86-64 |
|
SHA-256 checksum How to use checksums |
5d197d3f2274392614639e111cd54f56426d0c6c3653409f59725039fa6931d0
|
|
BLAKE2b-256 checksum How to use checksums |
06fd79c953f2f05d7a8b394cae0236954568998bb1dc56f11b89059a8e69201f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.1 CPython/3.9.20
|
Release files / libvmi-3.7.1-cp39-cp39-manylinux_2_28_x86_64.whl
| Download URL | libvmi-3.7.1-cp39-cp39-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 946.9 kB |
| Tags | CPython 3.9 Linux glibc 2.28+ x86-64 |
|
SHA-256 checksum How to use checksums |
604630333a21e1c5347463792a883e97ee95bf75df76459d2e360e3545af9412
|
|
BLAKE2b-256 checksum How to use checksums |
c986491d6a02434e5d66f4622f5a7bc189e8f41eaaaa8cc45152d9137825e3aa
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.1 CPython/3.9.20
|
Release files / libvmi-3.7.1-cp38-cp38-manylinux_2_28_x86_64.whl
| Download URL | libvmi-3.7.1-cp38-cp38-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 947.1 kB |
| Tags | CPython 3.8 Linux glibc 2.28+ x86-64 |
|
SHA-256 checksum How to use checksums |
254188a772fb57584e6bf259aa2256abfa63d0225bfc4246542489f16520d4d7
|
|
BLAKE2b-256 checksum How to use checksums |
9a4b5e64dee55585a866e2d2e8d14d72c18d03cc2e7e4c7d9ee796731a2d5212
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.1 CPython/3.9.20
|
Release files / libvmi-3.7.1-cp37-cp37m-manylinux_2_28_x86_64.whl
| Download URL | libvmi-3.7.1-cp37-cp37m-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 946.4 kB |
| Tags | CPython 3.7 CPython 3.7 pymalloc Linux glibc 2.28+ x86-64 |
|
SHA-256 checksum How to use checksums |
6039eb2ad65a3fb26367987f73d4f7e1fcbee61d3d99b5521ef60bbbe571ad96
|
|
BLAKE2b-256 checksum How to use checksums |
875b96ab29a5279027a7f902a9863776e46a3f3481dcde4370a54084636f36be
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.1 CPython/3.9.20
|