https://sci-hub.st/10.1145/2664243.2664252
libVMI -----> libxc/libxs -----> IOCTL -----> Dom0 Kernel -----> Xen Core
|| || || || ||
||---- Call -----||---- Call ----||-- Syscall ---||-- Hypercall ---||
FUNCTIONS:
drakvuf_loop - drakvuf_vmi_event_callback
vmi_events_listen - xen_events_listen
xen_init_vmi - driver_init_vmi
FUNCTIONALITY:
Search For KASLR Offset (linux_init)
XEN Specific
XEN Hypercall IOCTLs (privcmd)
DRAKVUF ON ARM/LINUX:
https://arm-drakvuf.blogspot.com/
https://github.com/tklengyel/drakvuf/issues/289
https://github.com/tklengyel/drakvuf/pull/226
![[Untitled 1111.png|https://www.acsac.org/2014/workshops/mmf/Bryan-Payne-An Introduction to Virtual Machione Introspection Using LibVMI.pdf]]
https://github.com/libvmi/libvmi