Welcome to Heimdall’s Documentation!

Getting started:

• Overview
• Installation
  • 1. Install libvmi
  • 2. Install Heimdall and libvmi-python
• Basic Usage
  • Step 1: Generate an ISF File
  • Step 2: Connect to the VM
  • Interacting with Heimdall Features via h
    • Current Capabilities
• Heimdall Core
  • Context
  • The Global k
  • Symbols Jar
  • Symbols
    • Creating a Symbol
      • 1. Using symbol (ASLR-Aware)
      • 2. Using file_symbol (Without ASLR)
      • Symbol with Type
    • Direct Memory Access with __getitem__ and __setitem__
      • Memory Access Methods
      • Example Workflow
• Future Plans for Heimdall
  • CLI
  • Core Features
  • OS Related
• Contributing
  • Step 1: Fork the Repository
  • Step 2: Create a New Branch
  • Step 3: Make Your Changes
  • Step 4: Test Your Code
  • Step 5: Commit Changes
  • Step 6: Push Changes
  • Step 7: Submit a PR
  • Example Python Function Documentation
    • Pull Request Template

API Reference:

• heimdall package
  • Subpackages
    • heimdall.cli package
      • Submodules
      • heimdall.cli.cli_common module
        • cb_isf()
        • cb_kvmi_socket()
        • prompt_selection()
        • sudo_required()
      • heimdall.cli.connect module
        • cli()
      • heimdall.cli.isf module
        • cli()
        • isf()
        • isf_callback()
        • isf_list()
        • isf_purge()
        • select_file()
      • heimdall.cli.isf_manager module
        • ISFManager
          • ISFManager.__init__()
          • ISFManager.create()
          • ISFManager.delete()
          • ISFManager.detect()
          • ISFManager.download()
          • ISFManager.list()
          • ISFManager.purge()
      • Module contents
    • heimdall.core package
      • Submodules
      • heimdall.core.access module
        • MemoryAccess
          • MemoryAccess.__init__()
          • MemoryAccess.read()
          • MemoryAccess.read_str()
          • MemoryAccess.read_ustr()
          • MemoryAccess.write()
          • MemoryAccess.write_str()
      • heimdall.core.context module
        • Context
          • Context.__init__()
          • Context.create_symbols_jar()
          • Context.file_symbol()
          • Context.peek()
          • Context.peek_str()
          • Context.peek_ustr()
          • Context.poke()
          • Context.symbol()
      • heimdall.core.descriptors module
        • ArrayKind
          • ArrayKind.__init__()
          • ArrayKind.count
          • ArrayKind.subtype
        • BaseKind
          • BaseKind.__init__()
          • BaseKind.fmt
        • BitFieldKind
          • BitFieldKind.__init__()
          • BitFieldKind.base_type
          • BitFieldKind.bit_length
          • BitFieldKind.bit_position
        • ClassKind
          • ClassKind.__init__()
        • ComplexKind
          • ComplexKind.__init__()
          • ComplexKind.fields
        • Descriptor
          • Descriptor.__init__()
          • Descriptor.name
        • EnumKind
          • EnumKind.__init__()
          • EnumKind.constants
        • Field
          • Field.__init__()
          • Field.offset
          • Field.type
        • FunctionKind
          • FunctionKind.__init__()
        • KindDescriptor
          • KindDescriptor.__init__()
          • KindDescriptor.size
        • PointerKind
          • PointerKind.__init__()
          • PointerKind.subtype
        • StructKind
          • StructKind.__init__()
        • SymbolDescriptor
          • SymbolDescriptor.__init__()
          • SymbolDescriptor.address
          • SymbolDescriptor.kind
        • UnionKind
          • UnionKind.__init__()
        • UnresolvedKind
          • UnresolvedKind.__init__()
          • UnresolvedKind.data
      • heimdall.core.isf_file module
        • ISFFile
          • ISFFile.__init__()
          • ISFFile.get_enum()
          • ISFFile.get_os_type()
          • ISFFile.get_symbol()
          • ISFFile.get_type()
          • ISFFile.validate_json()
        • OSType
          • OSType.LINUX
          • OSType.MACOS
          • OSType.WINDOWS
      • heimdall.core.symbol module
        • Symbol
          • Symbol.__init__()
          • Symbol.cast()
          • Symbol.disass()
          • Symbol.peek()
          • Symbol.peek_str()
          • Symbol.peek_ustr()
          • Symbol.poke()
      • heimdall.core.symbols_jar module
        • SymbolsJar
          • SymbolsJar.__init__()
          • SymbolsJar.get_enum()
          • SymbolsJar.get_symbol()
          • SymbolsJar.get_type()
      • Module contents
    • heimdall.os_related package
      • Subpackages
        • heimdall.os_related.base_os package
          • Submodules
          • heimdall.os_related.base_os.kernel_struct module
            • KernelStruct
              • KernelStruct.__init__()
              • KernelStruct.ks
          • heimdall.os_related.base_os.processes module
            • Process
              • Process.__init__()
              • Process.disass()
              • Process.file_symbol()
              • Process.name
              • Process.path
              • Process.peek()
              • Process.peek_str()
              • Process.peek_ustr()
              • Process.pid
              • Process.poke()
              • Process.slide()
              • Process.symbol()
            • Processes
              • Processes.__init__()
              • Processes.get_by_name()
              • Processes.get_by_pid()
              • Processes.list()
          • Module contents
        • heimdall.os_related.linux package
          • Submodules
          • heimdall.os_related.linux.filesystem module
            • LinuxFileSystem
              • LinuxFileSystem.dentry_full_path()
              • LinuxFileSystem.dentry_traversal()
          • heimdall.os_related.linux.linux_client module
            • LinuxClient
              • LinuxClient.__init__()
              • LinuxClient.kslide
              • LinuxClient.processes
          • heimdall.os_related.linux.processes module
            • LinuxProcess
              • LinuxProcess.name
              • LinuxProcess.path
              • LinuxProcess.pid
            • LinuxProcesses
              • LinuxProcesses.__init__()
              • LinuxProcesses.list()
          • Module contents
        • heimdall.os_related.macos package
          • Submodules
          • heimdall.os_related.macos.filesystem module
            • MacOSFileSystem
              • MacOSFileSystem.vnode_full_path()
              • MacOSFileSystem.vnode_traversal()
          • heimdall.os_related.macos.macos_client module
            • MacOSClient
              • MacOSClient.__init__()
              • MacOSClient.kslide
              • MacOSClient.processes
          • heimdall.os_related.macos.processes module
            • MacOSProcess
              • MacOSProcess.name
              • MacOSProcess.path
              • MacOSProcess.pid
            • MacOSProcesses
              • MacOSProcesses.__init__()
              • MacOSProcesses.list()
          • Module contents
        • heimdall.os_related.windows package
          • Submodules
          • heimdall.os_related.windows.processes module
            • WindowsProcess
              • WindowsProcess.name
              • WindowsProcess.path
              • WindowsProcess.pid
            • WindowsProcesses
              • WindowsProcesses.__init__()
              • WindowsProcesses.list()
          • heimdall.os_related.windows.windows_client module
            • WindowsClient
              • WindowsClient.__init__()
              • WindowsClient.kslide
              • WindowsClient.processes
          • Module contents
      • Module contents
    • heimdall.utils package
      • Submodules
      • heimdall.utils.utils module
        • download_file()
      • Module contents
  • Submodules
  • heimdall.create_client module
    • create_heimdall_client()
  • heimdall.exceptions module
    • AccessDeniedError
    • ConnectionFailedError
    • HeimdallException
    • SymbolsFileFormatError
    • SymbolsFileNotFoundError
    • SymbolsFileRemoteNotFoundError
    • VolatilitySymbols
      • VolatilitySymbols.__init__()
  • heimdall.heimdall_client module
    • ContextPrompt
      • ContextPrompt.in_prompt_tokens()
      • ContextPrompt.out_prompt_tokens()
    • HeimdallClient
      • HeimdallClient.__init__()
      • HeimdallClient.create_ctx()
      • HeimdallClient.interact()
      • HeimdallClient.kslide
      • HeimdallClient.processes
  • Module contents
• heimdall.core package
  • Submodules
  • heimdall.core.access module
    • MemoryAccess
      • MemoryAccess.__init__()
      • MemoryAccess.read()
      • MemoryAccess.read_str()
      • MemoryAccess.read_ustr()
      • MemoryAccess.write()
      • MemoryAccess.write_str()
  • heimdall.core.context module
    • Context
      • Context.__init__()
      • Context.create_symbols_jar()
      • Context.file_symbol()
      • Context.peek()
      • Context.peek_str()
      • Context.peek_ustr()
      • Context.poke()
      • Context.symbol()
  • heimdall.core.descriptors module
    • ArrayKind
      • ArrayKind.__init__()
      • ArrayKind.count
      • ArrayKind.subtype
    • BaseKind
      • BaseKind.__init__()
      • BaseKind.fmt
    • BitFieldKind
      • BitFieldKind.__init__()
      • BitFieldKind.base_type
      • BitFieldKind.bit_length
      • BitFieldKind.bit_position
    • ClassKind
      • ClassKind.__init__()
    • ComplexKind
      • ComplexKind.__init__()
      • ComplexKind.fields
    • Descriptor
      • Descriptor.__init__()
      • Descriptor.name
    • EnumKind
      • EnumKind.__init__()
      • EnumKind.constants
    • Field
      • Field.__init__()
      • Field.offset
      • Field.type
    • FunctionKind
      • FunctionKind.__init__()
    • KindDescriptor
      • KindDescriptor.__init__()
      • KindDescriptor.size
    • PointerKind
      • PointerKind.__init__()
      • PointerKind.subtype
    • StructKind
      • StructKind.__init__()
    • SymbolDescriptor
      • SymbolDescriptor.__init__()
      • SymbolDescriptor.address
      • SymbolDescriptor.kind
    • UnionKind
      • UnionKind.__init__()
    • UnresolvedKind
      • UnresolvedKind.__init__()
      • UnresolvedKind.data
  • heimdall.core.isf_file module
    • ISFFile
      • ISFFile.__init__()
      • ISFFile.get_enum()
      • ISFFile.get_os_type()
      • ISFFile.get_symbol()
      • ISFFile.get_type()
      • ISFFile.validate_json()
    • OSType
      • OSType.LINUX
      • OSType.MACOS
      • OSType.WINDOWS
  • heimdall.core.symbol module
    • Symbol
      • Symbol.__init__()
      • Symbol.cast()
      • Symbol.disass()
      • Symbol.peek()
      • Symbol.peek_str()
      • Symbol.peek_ustr()
      • Symbol.poke()
  • heimdall.core.symbols_jar module
    • SymbolsJar
      • SymbolsJar.__init__()
      • SymbolsJar.get_enum()
      • SymbolsJar.get_symbol()
      • SymbolsJar.get_type()
  • Module contents
• heimdall.cli package
  • Submodules
  • heimdall.cli.cli_common module
    • cb_isf()
    • cb_kvmi_socket()
    • prompt_selection()
    • sudo_required()
  • heimdall.cli.connect module
    • cli()
  • heimdall.cli.isf module
    • cli()
    • isf()
    • isf_callback()
    • isf_list()
    • isf_purge()
    • select_file()
  • heimdall.cli.isf_manager module
    • ISFManager
      • ISFManager.__init__()
      • ISFManager.create()
      • ISFManager.delete()
      • ISFManager.detect()
      • ISFManager.download()
      • ISFManager.list()
      • ISFManager.purge()
  • Module contents
• heimdall.os_related.base_os package
  • Submodules
  • heimdall.os_related.base_os.kernel_struct module
    • KernelStruct
      • KernelStruct.__init__()
      • KernelStruct.ks
  • heimdall.os_related.base_os.processes module
    • Process
      • Process.__init__()
      • Process.disass()
      • Process.file_symbol()
      • Process.name
      • Process.path
      • Process.peek()
      • Process.peek_str()
      • Process.peek_ustr()
      • Process.pid
      • Process.poke()
      • Process.slide()
      • Process.symbol()
    • Processes
      • Processes.__init__()
      • Processes.get_by_name()
      • Processes.get_by_pid()
      • Processes.list()
  • Module contents
• heimdall.os_related.macos package
  • Submodules
  • heimdall.os_related.macos.filesystem module
    • MacOSFileSystem
      • MacOSFileSystem.vnode_full_path()
      • MacOSFileSystem.vnode_traversal()
  • heimdall.os_related.macos.macos_client module
    • MacOSClient
      • MacOSClient.__init__()
      • MacOSClient.kslide
      • MacOSClient.processes
  • heimdall.os_related.macos.processes module
    • MacOSProcess
      • MacOSProcess.name
      • MacOSProcess.path
      • MacOSProcess.pid
    • MacOSProcesses
      • MacOSProcesses.__init__()
      • MacOSProcesses.list()
  • Module contents
• heimdall.os_related.linux package
  • Submodules
  • heimdall.os_related.linux.filesystem module
    • LinuxFileSystem
      • LinuxFileSystem.dentry_full_path()
      • LinuxFileSystem.dentry_traversal()
  • heimdall.os_related.linux.linux_client module
    • LinuxClient
      • LinuxClient.__init__()
      • LinuxClient.kslide
      • LinuxClient.processes
  • heimdall.os_related.linux.processes module
    • LinuxProcess
      • LinuxProcess.name
      • LinuxProcess.path
      • LinuxProcess.pid
    • LinuxProcesses
      • LinuxProcesses.__init__()
      • LinuxProcesses.list()
  • Module contents
• heimdall.os_related.windows package
  • Submodules
  • heimdall.os_related.windows.processes module
    • WindowsProcess
      • WindowsProcess.name
      • WindowsProcess.path
      • WindowsProcess.pid
    • WindowsProcesses
      • WindowsProcesses.__init__()
      • WindowsProcesses.list()
  • heimdall.os_related.windows.windows_client module
    • WindowsClient
      • WindowsClient.__init__()
      • WindowsClient.kslide
      • WindowsClient.processes
  • Module contents
• heimdall.utils package
  • Submodules
  • heimdall.utils.utils module
    • download_file()
  • Module contents