icebox | Virtual Machine Introspection , Tracing & Debugging | Code Inspection library

Otherwise, check our samples folder. You can build these samples with these instructions after you installed the requirements. If your using a Windows guest you might want to set the environement variable _NT_SYMBOL_PATH to a folder that contains your guest's pdb. Please note that icebox setup will fail if it does not find your guest's kernel's pdb. vm_resume: vm_resume just pause then resume your VM. nt_writefile: nt_writefile breaks when a process calls ntdll!NtWriteFile, and dumps what's written in a file on your host in the current directory. heapsan: heapsan breaks ntdll memory allocations from a process and add padding before & after every pointer. It is still incomplete and doesn't do any checks yet. wireshark: wireshark breaks when ndis driver reads or sends network packets and creates a wireshark trace (.pcapng). Each packet sent is associated to a callstack from kernel land to userland if necessary.