Is possible use Virtual Machine Introspection (VMI) for monitoring system calls and internal system operations in Oracle VirtualBox machine (if I use Linux as quest system) in this time? I have read few research papers about VMI, but unfortunately these projects are dead today... I know about LibVMI project, but it does not have support for VirtualBox. I would use it for monitoring of high-interaction honeypot.

Thanks for replies...

  • I see that you used the honeypot tag but don't seem to mention honeypots in your question. Is the tag incorrect or are honeypots somehow relevant? You should probably edit your question to clarify. Nov 1, 2015 at 0:38
  • @NeilSmithline tag is relevant I edited this yet.
    – Mato
    Nov 1, 2015 at 9:04
  • I don't think you can do this with VirtualBox, but you can take a look at drakvuf.com for an example on how such monitoring could work using Xen.
    – buherator
    Nov 1, 2015 at 10:56
  • @buherator thanks it looks amazing, but it supports only windows as quest system, do you know something similar with support Linux as quest system please?
    – Mato
    Nov 1, 2015 at 11:30
  • @Mato Unfortunately I don't. But I think DRAKVUF can give you some insight about how such a system should work. Maybe you can even reuse some code after implementing kernel symbol parsing.
    – buherator
    Nov 1, 2015 at 12:00

1 Answer 1


you should check the Winbagility project which provides the VMI APIs for VirtualBox (called FDP for Fast Debugging Protocol).

A library similar to libvmi has been written on top of it: icebox.

I don't believe that they will make a libvmi driver for FDP. The reason is that they used VirtualBox because it is a cross-platform hypervisor, so no need to be compatible with other hypervisors.

It's a late response, but it may help someone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .