pyplugins.apis package

Penguin APIs Package

This package contains core API plugins for the Penguin framework, providing interfaces for interacting with guest memory, user-space probes, and other hypervisor-level features.

Overview

• mem.py: Safe and efficient guest memory access and manipulation.

• uprobes.py: User-space probe (uprobe) registration and event handling.

• (Other API modules may be present for additional functionality.)

These APIs are designed to be used as plugins, enabling advanced instrumentation, tracing, and analysis of guest systems in a modular and extensible way.

—

Submodules

• pyplugins.apis.events module
  • Events API Plugin
    • Purpose
    • Usage
    • Event Format
    • Example
  • Events
    • register_notify()
• pyplugins.apis.execs module
  • Execs
    • Arguments
    • Plugin Interface
    • Overall Purpose
  • Execs
    • on_execve()
    • on_execveat()
• pyplugins.apis.fs module
  • FS API Plugin
    • Features
    • Example Usage
  • FS
    • exec_program()
    • read_file()
    • write_file()
• pyplugins.apis.kffi module
  • KFFI API Plugin
    • Features
    • Example usage
  • KFFI
    • call()
    • call_kernel_function()
    • callback()
    • cdef()
    • deref()
    • from_buffer()
    • generate_trampoline()
    • get_callback_id()
    • get_enum_dict()
    • get_field_casted()
    • get_function_address()
    • get_struct_size()
    • kallsyms_lookup()
    • kfree()
    • kmalloc()
    • new()
    • read_type()
    • read_type_panda()
    • ref()
    • sizeof()
• pyplugins.apis.mem module
  • Memory Access Plugin (mem.py)
    • Features
    • Example Usage
  • Mem
    • copy_buf_guest()
    • memcmp()
    • memset()
    • read_byte()
    • read_bytes()
    • read_bytes_panda()
    • read_char_ptrlist()
    • read_int()
    • read_int_array()
    • read_long()
    • read_long_array()
    • read_ptr()
    • read_ptr_array()
    • read_ptrlist()
    • read_str()
    • read_str_panda()
    • read_uint64_array()
    • read_utf8_str()
    • read_word()
    • write_byte()
    • write_bytes()
    • write_bytes_panda()
    • write_int()
    • write_int_array()
    • write_long()
    • write_ptr()
    • write_str()
    • write_word()
• pyplugins.apis.net module
  • Netdev
    • logger
    • name
    • netdev_ptr
    • setup()
  • Netdevs
    • get_netdev_state()
    • lookup_netdev()
    • register()
    • register_netdev()
    • set_netdev_state()
• pyplugins.apis.osi module
  • OSI Plugin (osi.py) for Penguin
    • Features
    • Example Usage
    • Purpose
  • OSI
    • get_args()
    • get_env()
    • get_fd_name()
    • get_fds()
    • get_mapping_by_addr()
    • get_mappings()
    • get_proc()
    • get_proc_exe()
    • get_proc_handles()
    • get_proc_name()
• pyplugins.apis.portalcall module
  • PortalCall Plugin (portalcall.py) for Penguin
    • Features
    • Example Usage
    • Classes
  • PortalCall
    • portalcall()
• pyplugins.apis.send_hypercall module
  • SendHypercall Plugin (send_hypercall.py) for Penguin
    • Features
    • Example Usage
  • SendHypercall
    • on_send_hypercall()
    • subscribe()
• pyplugins.apis.signals module
  • Signals Plugin (signals.py) for Penguin
    • Features
    • Example Usage
  • Signals
    • crash_snapshot()
    • dump()
    • self_abort()
    • self_signal()
    • signal_name_to_num()
• pyplugins.apis.static_fs module
  • StaticFS
    • exists()
    • get_size()
    • get_xattr()
    • list()
    • list_mode()
    • list_xattr()
    • open()
    • read()
    • statfs()
    • uninit()
• pyplugins.apis.symbols module
  • Symbols Plugin (symbols.py) for Penguin
    • Features
    • Example Usage
    • Purpose
  • Symbols
    • find_all()
    • get_offset()
    • list_symbols()
    • load_symbols()
    • lookup()
    • resolve_addr()
    • resolve_offset()
• pyplugins.apis.syscalls module
  • Syscalls Plugin System
    • Overview
    • Quick Start
    • Core Concepts
      • Syscall Events
      • Hook Registration
    • API Reference
      • Decorator Parameters
      • Advanced Filtering with ValueFilter
    • Handler Function Signatures
      • Standard Handlers
      • All-Syscall Handlers
    • SyscallEvent Object
    • SyscallPrototype Object
    • Practical Examples
      • Process Monitoring
      • File Access Monitoring
      • Network Monitoring
      • Return Value Analysis
      • Complex Filtering Example
    • Performance Considerations
      • Hook Granularity
      • Memory Access
      • Filtering Efficiency
    • Error Handling
      • Memory Access Failures
      • Portal Communication
    • Hook Management
      • Dynamic Control
      • Hook Information
    • Integration with Other Plugins
      • With Portal Plugin
      • With OSI Plugin
    • Testing
    • Troubleshooting
      • Common Issues
      • Debugging
    • Best Practices
  • Syscalls
    • syscall()
    • unregister()
  • ValueFilter
    • bitmask
    • bitmask_clear()
    • bitmask_set()
    • error()
    • exact()
    • filter_type
    • greater()
    • greater_equal()
    • less()
    • less_equal()
    • max_value
    • min_value
    • not_equal()
    • pattern
    • range()
    • string_contains()
    • string_endswith()
    • string_exact()
    • string_startswith()
    • success()
    • value
• pyplugins.apis.unwind module
  • Unwind Plugin (unwind.py)
  • ArchInfo
  • StackUnwinder
    • unwind()
• pyplugins.apis.uprobes module
  • Uprobes Plugin System
    • Overview
    • Quick Start
    • Core Concepts
      • Uprobe Events
      • Probe Registration
    • API Reference
      • Decorator Parameters
      • Handler Function Signature
    • pt_regs Object
    • Practical Examples
      • Monitor Function Entry
      • Monitor Function Return
      • Wildcard Library Matching
      • Register on All Libraries Containing a Symbol
      • Offset-based Probes
      • Process and PID Filtering
    • Performance Considerations
    • Error Handling
    • Hook Management
      • Dynamic Control
      • Probe Information
    • Integration with Other Plugins
      • With Portal Plugin
      • With OSI Plugin
    • Testing
    • Troubleshooting
      • Common Issues
      • Debugging
    • Best Practices
  • Uprobes
    • on_fs_init()
    • unregister()
    • uprobe()
    • uretprobe()