VMI

VMI Helpers for the IntroVirt Python Bindings.

class pyintrovirt.vmi.VMI(domain_id: int | str | None = None)

Bases: ContextDecorator

The main class used for Virtial Machine Introspection of guest domains.

attach(domain_id: int | str) → None

Attach to the target domain.

clear_system_call_filter()

Clear the system call filter if set.

clear_task_filter()

Clear the process filter.

default_system_call_filter()

Set the system call filter to the default set of supported system calls for the OS.

detach() → None

Detach from the domain. Safe to call multiple times.

filter_system_call_category(category: str)

Filter by a system call category.

filter_system_calls(syscalls: list[introvirt.SystemCallIndex | int | str])

Filter system calls to the list provided.

filter_task(name: str | None = None, pid: int | None = None, tid: int | None = None)

Filter processes by name (case-incensitive prefix), pid, or tid.

get_running_domains() → list[DomainInformation]

Get the running domains.

guest_os() → introvirt.OS

Get the guest OS type.

hypervisor_name() → str

Get the name of the hypervisor.

hypervisor_patch_version() → str

Get the patch version of the hypervisor.

hypervisor_version() → str

Get the version of the hypervisor.

intercept_cr_writes(cr: int, enabled: bool)

Intercept CR writes.

intercept_system_calls(enabled: bool)

Toggle system call interception on/off. Required to received system call events at all regardless of filter.

library_name() → str

Get the name of the library.

library_version() → str

Get the version of the library.

poll(blocking: bool = False)

Start the polling thread.

register_callback(event_type: introvirt.EventType, callback: EventCallback)

Register a callback for a given event type.

set_global_callback(callback: EventCallback)

Set the global callback that gets called for any event type.

syscall_categories() → tuple[str, ...]

Get a list of system call categories.

unfilter_system_calls(syscalls: list[introvirt.SystemCallIndex | str | int])

Remove the provided system calls from the filter.

unfilter_task(name: str | None = None, pid: int | None = None, tid: int | None = None)

Remove a process name, pid, or tid from the task filter.