Overview:

VmmVirtualMachine:

Sources:

Attributes:

virtualmachine.is_active    # bool: is the virtual machine active?
virtualmachine.is_physical  # bool: is the virtual machine a physical only virtual machine?
virtualmachine.is_readonly  # bool: is the virtual machine memory read-only or read-write?
virtualmachine.max_memory   # int: maximum guest physical memory address.
virtualmachine.name         # string: the name of the virtual machine.
virtualmachine.os_build     # int: build number of the guest windows virtual machine (0 if not available).
virtualmachine.type         # int: the virtual machine type as given by VMMDLL_VM_TP_*.

Methods:

# Create a new Vmm sub-analysis handle to analyze this Windows virtual machine.
# It's best to only call this function once per virtual machine and re-use the
# created Python Vmm object since this is a very performance intense operation.
# Please note that this is only possible on active Windows virtual machines.
-- return
virtualmachine.Vmm() # -> Vmm
# example:
#   virtualmachine.Vmm() # -> Vmm


# Read virtual machine guest physical memory.
# -- address_guest_physical
# -- size_to_read
# -- return
virtualmachine.read(int: address_guest_physical, int: size_to_read) # -> bytes
# example:
#   print(vmm.hex( virtualmachine.read(0x45000, 0x20) )) ->
#   0000    4d 5a 90 00 03 00 00 00  04 00 00 00 ff ff 00 00   MZ..............
#   0010    b8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00   ........@.......


# Write data (if supported) to the virtual machine guest physical memory.
# -- address_guest_physical
# -- data
vmm.memory.write(int: address_guest_physical, bytes: data) # -> None
# example:
#   virtualmachine.write(0x1000, b'0000')

# Initialize a Scatter Virtual Memory Read object which is used to simplify efficient memory reads.
# This is accomplished by using the simplified native MemProcFS VMMDLL_Scatter_* functionality.
# -- flags = flags as specified by memprocfs.FLAG_*.
# -- return
virtualmachine.scatter_initialize(opt int: flags) # -> VmmScatterMemory
# example:
#   vmm.memory.scatter_initialize(memprocfs.FLAG_NOCACHE) -> VmmScatterMemory