gdatasoftwareag / smartvmi

Virtual Machine Introspection (VMI) for memory forensics and machine-learning.

SmartVMI

Virtual Machine Introspection (VMI) for memory forensics and machine-learning.

SmartVMI Code

VmiCore

The SmartVMI project is split into a core component which manages access to the virtual machine and provides a high abstraction layer for ease of plugin implementation. See VmiCore Readme for additional information as well as how to build/use this project.

Plugins

To allow for easy extension SmartVMI provides a plugin interface. For information about writing your own plugin see the Plugins Readme. You can find already implemented plugins which also serve as examples for how to use this project in the plugins folder. For additional information see the corresponding plugin readme:

• Template Stripped down plugin to take your first steps with plugin development.
• InMemoryScanner
• ApiTracing

SmartVMI Research Project

The project “Synthesizing ML training data in the IT security domain for VMI-based attack detection and analysis” ( SmartVMI) is a research project funded by the BMBF and DLR. See: www.smartvmi.org for more information.

smartvmi's Issues

Breakpoint API: `BpResponse::Deactivate` always deletes physical breakpoint

BpResponse::Deactivate will always result in the physical breakpoint being deleted. This might break the workflow for other Breakpoint objects that have subscribed to the same breakpoint event.

Interrupt callback called twice

Rework breakpoint mechanism

Now that we have added the required funtionality to KVMi we can rework the breakpoint API in order to incorporate SLAT switches. This would enable us to use guests with more than one vCPU. It would also increase performance in situations where the memory page that contains a breakpoint is read by the guest.