ivcallmon
=========

API call monitor (ivcallmon).

Sets breakpoints on specified module!symbol patterns. Walks the process VAD tree
to find modules and uses PDB for symbol resolution (same as C++ ivcallmon).
Optional return breakpoints use read_guest_uint64 to read the return address from RSP.

Usage:
  sudo ivcallmon_py DOMAIN --procname NAME [SYMBOL ...]
  sudo python3 -m pyintrovirt.tools.ivcallmon DOMAIN --procname NAME 'ntdll!Nt*'

Example:
  sudo ivcallmon_py myvm --procname notepad.exe 'ntdll!NtCreateFile' 'ntdll!Nt*'

Default symbol set is ntdll!Nt* if none provided.

Requires root and IntroVirt-patched hypervisor.

Source
------

.. literalinclude:: ../../pyintrovirt/tools/ivcallmon.py
   :language: python