libvmi-python监控虚拟机

libvmi用起来比较复杂，真的不懂计算机的底层知识，照葫芦化瓢写了进程和模块获取：

import logging
from libvmi import Libvmi, VMIOS,  AccessContext, TranslateMechanism, PageMode
class Vmiapi(object):
    def __init__(self, vname):
        self.vname = vname
        self.vmi = Libvmi(vname)
        self.vmid = self.vmi.get_vmid()
        self.os = self.vmi.get_ostype()
    def get_offset(self):
        # init offsets values
        tasks_offset = None
        name_offset = None
        pid_offset = None
        if self.os == VMIOS.LINUX:
            tasks_offset = self.vmi.get_offset("linux_tasks")
            name_offset = self.vmi.get_offset("linux_name")
            pid_offset = self.vmi.get_offset("linux_pid")
        elif self.os == VMIOS.WINDOWS:
            tasks_offset = self.vmi.get_offset("win_tasks")
            name_offset = self.vmi.get_offset("win_pname")
            pid_offset = self.vmi.get_offset("win_pid")
        else:
            logging.info("Unknown OS")
            return 1
        return {'tasks_offset': tasks_offset, 'name_offset': name_offset, 'pid_offset': pid_offset}
    def list_process(self):
        offsets = self.get_offset()
        if self.os == VMIOS.LINUX:
            list_head = self.vmi.translate_ksym2v("init_task")
            list_head += offsets['tasks_offset']
        elif self.os ==VMIOS.WINDOWS:
            list_head = self.vmi.read_addr_ksym("PsActiveProcessHead")
        else:
            return 1
        cur_list_entry = list_head
        next_list_entry = self.vmi.read_addr_va(cur_list_entry, 0)
        processess = []
        headers = ['pid','procename', 'current_process']
        while True:
            current_process = cur_list_entry - offsets['tasks_offset']
            pid = self.vmi.read_32_va(current_process + offsets['pid_offset'], 0)
            procname = self.vmi.read_str_va(current_process + offsets['name_offset'], 0)
            Dict = dict(zip(headers,[pid, procname,
                         hex(current_process)]))
            processess.append(Dict)
            cur_list_entry = next_list_entry
            next_list_entry = self.vmi.read_addr_va(cur_list_entry, 0)

            if self.os == VMIOS.WINDOWS and next_list_entry == list_head:
                break
            elif self.os == VMIOS.LINUX and cur_list_entry == list_head:
                break
        return processess
    def list_module(self):
        os = self.os
        if os == VMIOS.LINUX:
            next_module = self.vmi.read_addr_ksym("modules")
        elif os == VMIOS.WINDOWS:
            next_module = self.vmi.read_addr_ksym("PsLoadedModuleList")
        else:
            logging.info("Unknown OS")
        list_head = next_module
        while True:
            # follow the next pointer
            tmp_next = self.vmi.read_addr_va(next_module, 0)

            # if we are back at the list head, we are done
            if list_head == tmp_next:
                break

            page_mode = self.vmi.get_page_mode(0)
            modname = None
            # print out the module name
            if os == VMIOS.LINUX:
                if page_mode == PageMode.IA32E:
                    modname = self.vmi.read_str_va(next_module + 16, 0)
                else:
                    modname = self.vmi.read_str_va(next_module + 8, 0)

            elif os == VMIOS.WINDOWS:
                if page_mode == PageMode.IA32E:
                        modname = self.vmi.read_unicode_str_va(next_module + 0x58, 0)
                else:
                    modname = self.vmi.read_unicode_str_va(next_module + 0x2c, 0)

            else:
                logging.info("Unkown OS")

            if modname is not None:
                print(modname)
            next_module = tmp_next