// libvmi/events.h

#define VMI_EVENT_INVALID           0
#define VMI_EVENT_MEMORY            1   /**< Read/write/execute on a region of memory */
#define VMI_EVENT_REGISTER          2   /**< Read/write of a specific register */
#define VMI_EVENT_SINGLESTEP        3   /**< Instructions being executed on a set of VCPUs */
#define VMI_EVENT_INTERRUPT         4   /**< Interrupts being delivered */
#define VMI_EVENT_GUEST_REQUEST     5   /**< Guest-requested event */
#define VMI_EVENT_CPUID             6   /**< CPUID event */
#define VMI_EVENT_DEBUG_EXCEPTION   7   /**< Debug exception event */
#define VMI_EVENT_PRIVILEGED_CALL   8   /**< Privileged call (ie. SMC on ARM) */
#define VMI_EVENT_DESCRIPTOR_ACCESS 9   /**< A descriptor table register was accessed */
#define VMI_EVENT_FAILED_EMULATION  10  /**< Emulation failed when requested by VMI_EVENT_RESPONSE_EMULATE */
#define VMI_EVENT_DOMAIN_WATCH      11  /**< Watch create/destroy events */

// libvmi/events.h

struct vmi_event {
    /* CONST IN */
    uint32_t version; /**< User should set it to VMI_EVENTS_VERSION */

    /* CONST IN */
    vmi_event_type_t type;  /**< The specific type of event */

    /**
     * IN/OUT/RESPONSE
     *
     * The VMM maintained SLAT ID. Can be specified when registering mem_event (IN).
     * On an event report (OUT) specifies the active SLAT ID on the vCPU.
     * Iff VMI_EVENT_RESPONSE_SLAT_ID is set (RESPONSE), switch the vCPU to this VMM pagetable ID.
     *
     * Note: on Xen this corresponds to the altp2m_idx.
     */
    uint16_t slat_id;

    /**
     * RESPONSE
     *
     * The VMM should switch to this SLAT ID on the occurance of the next event.
     * Iff VMI_EVENT_RESPONSE_NEXT_SLAT_ID is set.
     *
     * Note: on Xen this corresponds to the altp2m_idx and it also enables MTF singlestepping.
     *  The altp2m switch automatically happens in the singlestep handler in Xen after a single
     *  instruction is executed.
     */
    uint16_t next_slat_id;

    /**
     * CONST IN
     *
     * An open-ended mechanism allowing a library user to
     *  associate external data to the event.
     * Metadata assigned to this pointer at any time (prior to
     *  or following registration) is delivered to the callback,
     *  for each matching event. The callback is also free to
     *  modify in any way. The library user assumes all memory
     *  management for this referenced data.
     */
    void *data;

    /**
     * CONST IN
     *
     * The callback function that is invoked when the relevant is observed.
     */
    event_callback_t callback;

    /* OUT */
    uint32_t vcpu_id; /**< The VCPU relative to which the event occurred. */

    /**
     * Reserved for future use
     */
    uint32_t _reserved[7];

    union {
        reg_event_t reg_event;
        mem_access_event_t mem_event;
        single_step_event_t ss_event;
        interrupt_event_t interrupt_event;
        privcall_event_t privcall_event;
        cpuid_event_t cpuid_event;
        debug_event_t debug_event;
        descriptor_event_t descriptor_event;
        watch_domain_event_t watch_event;
    };

    /*
     * Note that the following pointers assume compiler compatibility
     * ie. if you compiled a 32-bit version of LibVMI it will be
     * incompatable with 64-bit tools and vice verse.
     */
    union {
        /**
         * OUT
         *
         * Snapshot of some VCPU registers when the event occurred
         */
        union {
            x86_registers_t *x86_regs;
            arm_registers_t *arm_regs;
        };

        /**
         * RESPONSE
         *
         * Read data to be sent back with VMI_EVENT_RESPONSE_SET_EMUL_READ_DATA
         */
        emul_read_t *emul_read;

        /**
         * RESPONSE
         *
         * Instruction buffer to be sent back with VMI_EVENT_RESPONSE_SET_EMUL_INSN
         */
        emul_insn_t *emul_insn;
    };
};

// libvmi/events.h

typedef struct {
    /**
     * CONST IN
     *
     * Register for which write event is configured.
     * Hypervisors offering register events tend to
     *  have a limited number available for monitoring.
     * These registers tend to be those defined as
     * 'sensitive register instructions' by Popek and
     *  Goldberg, meaning that the registers trigger
     *  a VMEXIT, trap, or equivalent.
     *
     * Note for MSR events on Xen: up to Xen 4.7 only MSR_ALL is supported.
     *  Starting with Xen 4.8 the user has the option to subscribe to specific
     *  MSR events, or to continue using MSR_ALL. However, in this case MSR_ALL
     *  only corresponds to common MSRs that are defined by LibVMI in libvmi.h.
     *  To subscribe to MSR events that are NOT defined by LibVMI, the user can specify
     *  MSR_UNDEFINED here and then set the specific MSR index in the 'msr' field
     *  below.
     */
    reg_t reg;

    /**
     * CONST IN
     *
     * Event filter: callback triggers IFF register==<equal>
     */
    reg_t equal;

    /**
     * CONST IN
     *
     * IFF set to 1, events are delivered asynchronously and
     *  without pausing the originating VCPU
     * Default : 0. (i.e., VCPU is paused at time of event delivery).
     */
    uint8_t async;

    /**
     * CONST IN
     *
     * IFF set to 1, events are only delivered if the written
     *  value differs from the previously held value.
     * Default : 0. (i.e., All write events are delivered).
     */
    uint8_t onchange;

    /**
     * CONST IN
     *
     * Type of register event being monitored.
     * Hypervisors offering register events do so only for those that trigger a
     *  VMEXIT or similar trap. This predominantly means that only write events
     *  are supported by the corresponding LibVMI driver
     */
    vmi_reg_access_t in_access;

    /**
     * OUT
     *
     * Type of register access that triggered the event
     */
    vmi_reg_access_t out_access;

    uint32_t _pad;

    /**
     * OUT
     *
     * Register value read or written
     */
    reg_t value;

    /**
     * OUT
     *
     * Previous value of register (only for CR0/CR3/CR4/MSR)
     */
    reg_t previous;

    /**
     * CONST IN/OUT
     *
     * MSR register operations only
     *
     * CONST IN: Starting from Xen 4.8 the user can use this field to specify an
     *  MSR index to subscribe to when the MSR is not formally defined by LibVMI.
     *
     * OUT: holds the specific MSR for which the event occurred
     *  when the user registered with MSR_ALL.
     * Unused for other register event types.
     */
    uint32_t msr;
} reg_event_t;

// cr3-event-example.c

...

event_response_t my_callback(vmi_instance_t vmi, vmi_event_t *event)
{
    (void)vmi;
    printf("CR3 write happened: Value=0x%"PRIx64"\n", event->reg_event.value);
    printf("\tvcpu_id=0x%"PRIx64"\n", event->vcpu_id);
    printf("\trbx=0x%"PRIx64"\n", event->x86_regs->rbx);
    printf("\tcr0=0x%"PRIx64"\n", event->x86_regs->cr0);
    printf("\tprevious CR3 value=0x%"PRIx64"\n", event->reg_event.previous);
    return VMI_EVENT_RESPONSE_NONE;
}

...

int main (int argc, char **argv)
{
	...
    vmi_event_t my_event = {0};
    my_event.version = VMI_EVENTS_VERSION;
    my_event.type = VMI_EVENT_REGISTER;
    my_event.callback = my_callback;
    my_event.reg_event.reg = CR3;
    my_event.reg_event.in_access = VMI_REGACCESS_W;
    ...
}

int main (int argc, char **argv)
{
    ...
    // 添加变量
    vmi_pid_t pid = 0, ppid = 0;
    unsigned long tasks_offset = 0, pid_offset = 0, name_offset = 0, pdbase_offset = 0;
	...

    /* init the offset values */
    if (VMI_OS_LINUX == vmi_get_ostype(vmi)) {
        if ( VMI_FAILURE == vmi_get_offset(vmi, "linux_tasks", &tasks_offset) )
            goto error_exit;
        if ( VMI_FAILURE == vmi_get_offset(vmi, "linux_name", &name_offset) )
            goto error_exit;
        if ( VMI_FAILURE == vmi_get_offset(vmi, "linux_pid", &pid_offset) )
            goto error_exit;
    } else if (VMI_OS_WINDOWS == vmi_get_ostype(vmi)) {
        if ( VMI_FAILURE == vmi_get_offset(vmi, "win_tasks", &tasks_offset) )
            goto error_exit;
        if ( VMI_FAILURE == vmi_get_offset(vmi, "win_pname", &name_offset) )
            goto error_exit;
        if ( VMI_FAILURE == vmi_get_offset(vmi, "win_pid", &pid_offset) )
            goto error_exit;
        // 添加获取win_pdbase的步骤
        if ( VMI_FAILURE == vmi_get_offset(vmi, "win_pdbase", &pdbase_offset) )
            goto error_exit;
    } else if (VMI_OS_FREEBSD == vmi_get_ostype(vmi)) {
        tasks_offset = 0;
        if ( VMI_FAILURE == vmi_get_offset(vmi, "freebsd_name", &name_offset) )
            goto error_exit;
        if ( VMI_FAILURE == vmi_get_offset(vmi, "freebsd_pid", &pid_offset) )
            goto error_exit;
    }

    ...

    /* walk the task list */
    while (1) {

        current_process = cur_list_entry - tasks_offset;

        /* Note: the task_struct that we are looking at has a lot of
         * information.  However, the process name and id are burried
         * nice and deep.  Instead of doing something sane like mapping
         * this data to a task_struct, I'm just jumping to the location
         * with the info that I want.  This helps to make the example
         * code cleaner, if not more fragile.  In a real app, you'd
         * want to do this a little more robust :-)  See
         * include/linux/sched.h for mode details */

        /* NOTE: _EPROCESS.UniqueProcessId is a really VOID*, but is never > 32 bits,
         * so this is safe enough for x64 Windows for example purposes */
        vmi_read_32_va(vmi, current_process + pid_offset, 0, (uint32_t*)&pid);

        procname = vmi_read_str_va(vmi, current_process + name_offset, 0);

        // 根据偏移获取各种进程、线程信息
        uint32_t pdbase = 0;
        vmi_read_32_va(vmi, current_process + pdbase_offset, 0, (uint32_t*)&pdbase);

        vmi_read_32_va(vmi, current_process + 0x140, 0, (uint32_t*)&ppid);

        vmi_read_addr_va(vmi, current_process + 0x188, 0, (addr_t*)&ThreadListHead);
        ThreadListHead = ThreadListHead - 0x268;

        int64_t CreateTime = 0;
        vmi_read_64_va(vmi, ThreadListHead + 0x200, 0, &CreateTime);

        uint32_t Cid = 0;
        vmi_read_64_va(vmi, ThreadListHead + 0x22c, 0, (uint32_t*)&Cid);

        if (!procname) {
            printf("Failed to find procname\n");
            goto error_exit;
        }

        /* print out the process name */
        if((pid > 5) && (strcmp(procname, "svchost.exe") != 0)) {
        	printf("[%5d] %s (struct addr:%"PRIx64"), pdbase:%"PRIx64", ppid:%5d\n", pid, procname, current_process, pdbase, ppid);
            // 添加我们需要的输出语句
			printf("ThreadListHead:%"PRIx64"\n", ThreadListHead);
        	printf("thread createtime:%ld\n", CreateTime);
        	printf("Cid:%5d\n", Cid);
        }

    ...
}

➜  build git:(5882bc2) ✗ examples/vmi-process-list -n win7 -s /tmp/introspector
LibVMI Suggestion: set win_ntoskrnl=0x3c14000 in libvmi.conf for faster startup.
LibVMI Suggestion: set win_kdbg=0x12ac28 in libvmi.conf for faster startup.
LibVMI Suggestion: set win_kdvb=0x83d3ec28 in libvmi.conf for faster startup.
Process listing for VM win7 (id=4)
[  224] smss.exe (struct addr:975deae0), pdbase:7ee0d020, ppid:    4
ThreadListHead:975de808
thread createtime:133255839485781250
Cid:  224
[  304] csrss.exe (struct addr:86d40768), pdbase:7ee0d060, ppid:  296
ThreadListHead:85cc87b0
thread createtime:133255839501718750
Cid:  304
[  352] wininit.exe (struct addr:92c8dd40), pdbase:7ee0d0a0, ppid:  296
ThreadListHead:85cb3770
thread createtime:133255839501875000
Cid:  352
[  360] csrss.exe (struct addr:86d46030), pdbase:7ee0d040, ppid:  344
ThreadListHead:85cad828
thread createtime:133255839502968750
Cid:  360
[  400] winlogon.exe (struct addr:85cad420), pdbase:7ee0d0c0, ppid:  344
ThreadListHead:86c07d48
thread createtime:133255839503125000
Cid:  400
[  444] services.exe (struct addr:86dca5e8), pdbase:7ee0d080, ppid:  352
ThreadListHead:86e0f030
thread createtime:133255839506718750
Cid:  444
[  452] lsass.exe (struct addr:86e124e0), pdbase:7ee0d0e0, ppid:  352
ThreadListHead:86e20030
thread createtime:133255839507656250
Cid:  452
[  460] lsm.exe (struct addr:86e14828), pdbase:7ee0d100, ppid:  352
ThreadListHead:86e144a0
thread createtime:133255839507187500
Cid:  460
[ 1200] dwm.exe (struct addr:86f26030), pdbase:7ee0d280, ppid:  808
ThreadListHead:86f26658
thread createtime:133255839526718750
Cid: 1200
......