mirror of
https://github.com/martanne/WinPmem-BitLocker
synced 2026-06-08 15:44:10 +00:00
Prepare for release (#8)
This commit is contained in:
Mike Cohen
@@ -4,7 +4,6 @@ Winpmem has been the default open source memory acquisition driver for
|
||||
windows for a long time. It used to live in the Rekall project, but
|
||||
has recently been separated into its own repository.
|
||||
|
||||
|
||||
## Copyright
|
||||
|
||||
This code was originally developed within Google but was released
|
||||
@@ -16,9 +15,9 @@ Winpmem is a physical memory imager with the following features:
|
||||
|
||||
- Open source
|
||||
|
||||
- Support for WinXP - Win 10, x86 + x64. The WDK7600 can be used to
|
||||
- Support for WinXP - Win 10, x86 + x64. The WDK7600 can be used to
|
||||
include WinXP support.
|
||||
As default, the provided Winpmem executables will be compiled with WDK10,
|
||||
As default, the provided Winpmem executables will be compiled with WDK10,
|
||||
supporting Win7 - Win10, and featuring more modern code.
|
||||
|
||||
- Three different independent methods to create a memory dump.
|
||||
@@ -36,75 +35,77 @@ are available under the following license: Apache License, Version 2.0
|
||||
|
||||
### How to use
|
||||
|
||||
There are two winpmem executables: winpmem.exe and winpmem64.exe.
|
||||
Both versions contain both drivers (32 and 64 bit versions). It does
|
||||
not matter which version is invoked, it will choose the right driver anyway.
|
||||
|
||||
(Winpmem64.exe can be used in a special environment with no WOW64 emulation
|
||||
support (such as WINPE) and/or the need for the native bitness.)
|
||||
|
||||
The python program is currently under construction.
|
||||
There are two winpmem executables: winpmem_mini_x86.exe and winpmem_mini_x64.exe.
|
||||
Both versions contain both drivers (32 and 64 bit versions).
|
||||
|
||||
The mini in the binary name refers to this imager being a plain simple
|
||||
imager - it can only produce images in RAW format. In the past we
|
||||
release a WinPmem imager based on AFF4 but that one is yet to be updated to the new driver. Please let us know if you need the AFF4 based imager.
|
||||
|
||||
### The Python acquitision tool winpmem.py
|
||||
|
||||
Under construction by Scudette.
|
||||
The python program is currently under construction but works as a demonstration for how one can use the imager from Python.
|
||||
|
||||
|
||||
|
||||
### winpmem.exe (standalone executable)
|
||||
### winpmem_mini_x64.exe (standalone executable)
|
||||
|
||||
This program is easiest to use for incident response since it requires no other
|
||||
dependencies than the executable itself. The program will load the correct
|
||||
driver (32 bit or 64 bit) automatically and is self-contained.
|
||||
|
||||
NOTE: Currently it is testsigned and needs "bcdedit /set testsigning on" (and reboot).
|
||||
This a permanent setting. Use "bcdedit /set testsigning off" (and reboot) to switch it off again.
|
||||
|
||||
NOTE: Do not forget to invoke winpmem as admin/elevated!
|
||||
|
||||
##### Examples:
|
||||
|
||||
winpmem.exe physmem.raw
|
||||
`winpmem_mini_x64.exe physmem.raw`
|
||||
|
||||
Writes a raw image to physmem.raw using the default method of acquisition.
|
||||
|
||||
winpmem.exe
|
||||
`winpmem_mini_x64.exe`
|
||||
|
||||
Invokes the usage print / short manual.
|
||||
|
||||
To acquire a raw image using specifically the MmMapIoSpace method:
|
||||
|
||||
winpmem.exe -1 myimage.raw
|
||||
`winpmem.exe -1 myimage.raw`
|
||||
|
||||
The driver will be automatically unloaded after the image is acquired!
|
||||
|
||||
|
||||
|
||||
Experimental write support
|
||||
--------------------------
|
||||
|
||||
The winpmem drivers support writing to memory as well as reading.
|
||||
The winpmem source code supports writing to memory as well as reading.
|
||||
This capability is a great learning tool since many rootkit hiding
|
||||
techniques can be emulated by writing to memory directly.
|
||||
techniques can be emulated by writing to memory directly.
|
||||
|
||||
This functionality should be used with extreme caution!
|
||||
|
||||
NOTE: Since this is a rather dangerous capability, the signed binary drivers
|
||||
have write support disabled. The unsigned binaries (really self signed with a
|
||||
test certificate) can not load on a regular system due to them being test self
|
||||
signed. You can allow the unsigned drivers to be loaded on a test system by
|
||||
issuing (see
|
||||
NOTE: Since this is a rather dangerous capability, the signed binary
|
||||
drivers have write support disabled. You can rebuild the drivers to
|
||||
produce test signed binaries if you want to use this feature. The
|
||||
unsigned binaries (really self signed with a test certificate) can not
|
||||
load on a regular system due to them being test self signed, but you can
|
||||
allow the unsigned drivers to be loaded on a test system by issuing
|
||||
(see
|
||||
http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484(v=vs.85).aspx):
|
||||
|
||||
Bcdedit.exe -set TESTSIGNING ON
|
||||
`Bcdedit.exe -set TESTSIGNING ON`
|
||||
|
||||
and reboot. You will see a small "Test Mode" text on the desktop to remind you
|
||||
that this machine is configured for test signed drivers.
|
||||
|
||||
Additionally, Write support must also be enabled at load time:
|
||||
|
||||
winpmem.exe -w -l
|
||||
`winpmem.exe -w -l`
|
||||
|
||||
This will load the drivers and turn on write support.
|
||||
|
||||
# Acknowledgments
|
||||
|
||||
This project would also not be possible without support from the wider
|
||||
DFIR community:
|
||||
|
||||
* We would like to thank Emre Tinaztepe and our other supporters at
|
||||
[Binalyze](https://binalyze.com/).
|
||||
|
||||
Our open source contributors:
|
||||
|
||||
* Viviane Zwanger
|
||||
* Mike Cohen
|
||||
|
||||
+4
-6
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -87,8 +87,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -87,8 +87,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
|
||||
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
|
||||
+16
-87
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -87,104 +87,33 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="container pt-2 pt-md-6 pb-3 pb-md-6">
|
||||
<div class="row">
|
||||
<div class="col-12 col-md-3 mb-3">
|
||||
<div class="sidebar">
|
||||
|
||||
<div class="docs-menu">
|
||||
<h4>Docs</h4>
|
||||
<ul>
|
||||
|
||||
<li class="">
|
||||
<a href="https://winpmem.velocidex.com/docs/usage/">Overview</a>
|
||||
</li>
|
||||
|
||||
<li class="">
|
||||
<a href="https://winpmem.velocidex.com/docs/memory/">Acquiring Memory</a>
|
||||
</li>
|
||||
|
||||
<li class="">
|
||||
<a href="https://winpmem.velocidex.com/docs/files/">Acquiring Files</a>
|
||||
</li>
|
||||
|
||||
<li class="">
|
||||
<a href="https://winpmem.velocidex.com/docs/inspecting/">Inspecting AFF4 volumes</a>
|
||||
</li>
|
||||
|
||||
<li class="">
|
||||
<a href="https://winpmem.velocidex.com/docs/extracting/">Extracting streams from AFF4 volumes</a>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-12 col-md-9">
|
||||
|
||||
|
||||
<span class="overview">Overview</span>
|
||||
<h1 class="title">Winpmem Documentation</h1>
|
||||
<div class="content">
|
||||
<h2 id="documentation">Documentation</h2>
|
||||
<p>This is the winpmem documentation.</p>
|
||||
<p>We currently release a simple imager which can only write RAW
|
||||
images. Simple run it with the name of the image file:</p>
|
||||
<p><code>winpmem_mini_x64.exe physmem.raw</code></p>
|
||||
<h1 id="acquisition-modes">Acquisition modes.</h1>
|
||||
<p>Three acquisition modes are implemented:</p>
|
||||
<ol>
|
||||
<li>PTE remapping mode - this is the default and is the most stable</li>
|
||||
<li>MMMapIoSpace mode - uses the MMMapIoSpace kernel API</li>
|
||||
<li>PhysicalMemory mode - passes a handle to the tradition <code>\\.\PhysicalMemory</code> device.</li>
|
||||
</ol>
|
||||
<h1 id="reporting-issues">Reporting issues</h1>
|
||||
<p>There is an issue board at <a href="https://github.com/Velocidex/WinPmem/issues">https://github.com/Velocidex/WinPmem/issues</a></p>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
<div class="summary mb-2">
|
||||
|
||||
<h2 class="title-summary"><a href="https://winpmem.velocidex.com/docs/usage/">Overview</a></h2>
|
||||
<p>WinPmem is developed as part of the AFF4 imager project. AFF4 is an advanced, open forensic imaging format. The format has been standardized in the AFF4 Standard Specification, and it is increasing more supported by other tools.
|
||||
WinPmem by default will use AFF4 to store the memory image, but it is also possible to write the image in RAW format or ELF format. You might want to do this if you are going to use the image with tools that can not read AFF4 natively.</p>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="summary mb-2">
|
||||
|
||||
<h2 class="title-summary"><a href="https://winpmem.velocidex.com/docs/memory/">Acquiring Memory</a></h2>
|
||||
<p>Acquiring memory using WinPmem is a very simple process:
|
||||
F:\>winpmem.exe -o test.aff4 -dd 2019-05-17 02:26:22 I This is The WinPmem memory imager. version 3.3rc1 2019-05-17 02:26:22 I Extracted 45368 bytes into C:\Users\test\AppData\Local\Temp\pmeB5CC.tmp 2019-05-17 02:26:22 I Driver Unloaded. 2019-05-17 02:26:22 I Loaded Driver C:\Users\test\AppData\Local\Temp\pmeB5CC.tmp 2019-05-17 02:26:22 I Setting acquisition mode 2 2019-05-17 02:26:22 I CR3: 0x00001AA000 5 memory ranges: Start 0x00001000 - Length 0x0009E000 Start 0x00100000 - Length 0x00002000 Start 0x00103000 - Length 0xBFDDD000 Start 0xBFF00000 - Length 0x00100000 Start 0x100000000 - Length 0x52400000 2019-05-17 02:26:22 W Output file test.</p>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="summary mb-2">
|
||||
|
||||
<h2 class="title-summary"><a href="https://winpmem.velocidex.com/docs/files/">Acquiring Files</a></h2>
|
||||
<p>The WinPmem imager can also acquire multiple files into the AFF4 volume. These can be devices (such as disks using /dev/sda) or logical files.
|
||||
Acquiring a disk image WinPmem.exe -i \\.\c: -o output.aff4 -dd Note that by default the aff4 imager will append new streams to the output volume if it already exists. This is useful for appending more relevant evidence after the initial acquisition is completed. If you dont want this behaviour you can specify the -t (–truncate) flag to truncate the output volume before adding the new stream.</p>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="summary mb-2">
|
||||
|
||||
<h2 class="title-summary"><a href="https://winpmem.velocidex.com/docs/inspecting/">Inspecting AFF4 volumes</a></h2>
|
||||
<p>AFF4 volumes are based around the common Zip compression standard (for large volumes we use Zip64 extensions). Therefore it is possible to examine AFF4 volumes using common zip utilities.
|
||||
⟫ unzip -l /tmp/test.aff4 Archive: /tmp/test.aff4 aff4://c7c60030-cc3e-43a6-b5d1-1551b29c9918 Length Date Time Name --------- ---------- ----- ---- 189432 2018-01-15 12:50 usr/bin/mksquashfs 951952 2018-01-15 12:50 usr/bin/x86_64-w64-mingw32-cpp ... 50929 2018-01-15 12:50 information.turtle ... --------- ------- 315748394 327 files We can see that each volume has a unique URN, and it contains a file called “information.</p>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="summary mb-2">
|
||||
|
||||
<h2 class="title-summary"><a href="https://winpmem.velocidex.com/docs/extracting/">Extracting streams from AFF4 volumes</a></h2>
|
||||
<p>Analysis tools which already support AFF4 will be able to use the AFF4 image directly, but sometimes you may come across a tool which does not. In this case you will want to extract the RAW streams out of the AFF4 volume.
|
||||
To extract streams from an AFF4 volume we use the -e flag.
|
||||
Extract streams by using wild cards WinPmem.exe -e '*/kallsyms' --export_dir /tmp/export/ /tmp/test.aff4 By default export directory is the current directory.</p>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -6,56 +6,5 @@
|
||||
<description>Recent content in Winpmem Documentation on WinPmem memory imager</description>
|
||||
<generator>Hugo -- gohugo.io</generator>
|
||||
<language>en-us</language><atom:link href="https://winpmem.velocidex.com/docs/index.xml" rel="self" type="application/rss+xml" />
|
||||
<item>
|
||||
<title>Overview</title>
|
||||
<link>https://winpmem.velocidex.com/docs/usage/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/usage/</guid>
|
||||
<description>WinPmem is developed as part of the AFF4 imager project. AFF4 is an advanced, open forensic imaging format. The format has been standardized in the AFF4 Standard Specification, and it is increasing more supported by other tools.
|
||||
WinPmem by default will use AFF4 to store the memory image, but it is also possible to write the image in RAW format or ELF format. You might want to do this if you are going to use the image with tools that can not read AFF4 natively.</description>
|
||||
</item>
|
||||
|
||||
<item>
|
||||
<title>Acquiring Memory</title>
|
||||
<link>https://winpmem.velocidex.com/docs/memory/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/memory/</guid>
|
||||
<description>Acquiring memory using WinPmem is a very simple process:
|
||||
F:\&gt;winpmem.exe -o test.aff4 -dd 2019-05-17 02:26:22 I This is The WinPmem memory imager. version 3.3rc1 2019-05-17 02:26:22 I Extracted 45368 bytes into C:\Users\test\AppData\Local\Temp\pmeB5CC.tmp 2019-05-17 02:26:22 I Driver Unloaded. 2019-05-17 02:26:22 I Loaded Driver C:\Users\test\AppData\Local\Temp\pmeB5CC.tmp 2019-05-17 02:26:22 I Setting acquisition mode 2 2019-05-17 02:26:22 I CR3: 0x00001AA000 5 memory ranges: Start 0x00001000 - Length 0x0009E000 Start 0x00100000 - Length 0x00002000 Start 0x00103000 - Length 0xBFDDD000 Start 0xBFF00000 - Length 0x00100000 Start 0x100000000 - Length 0x52400000 2019-05-17 02:26:22 W Output file test.</description>
|
||||
</item>
|
||||
|
||||
<item>
|
||||
<title>Acquiring Files</title>
|
||||
<link>https://winpmem.velocidex.com/docs/files/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/files/</guid>
|
||||
<description>The WinPmem imager can also acquire multiple files into the AFF4 volume. These can be devices (such as disks using /dev/sda) or logical files.
|
||||
Acquiring a disk image WinPmem.exe -i \\.\c: -o output.aff4 -dd Note that by default the aff4 imager will append new streams to the output volume if it already exists. This is useful for appending more relevant evidence after the initial acquisition is completed. If you dont want this behaviour you can specify the -t (&ndash;truncate) flag to truncate the output volume before adding the new stream.</description>
|
||||
</item>
|
||||
|
||||
<item>
|
||||
<title>Inspecting AFF4 volumes</title>
|
||||
<link>https://winpmem.velocidex.com/docs/inspecting/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/inspecting/</guid>
|
||||
<description>AFF4 volumes are based around the common Zip compression standard (for large volumes we use Zip64 extensions). Therefore it is possible to examine AFF4 volumes using common zip utilities.
|
||||
⟫ unzip -l /tmp/test.aff4 Archive: /tmp/test.aff4 aff4://c7c60030-cc3e-43a6-b5d1-1551b29c9918 Length Date Time Name --------- ---------- ----- ---- 189432 2018-01-15 12:50 usr/bin/mksquashfs 951952 2018-01-15 12:50 usr/bin/x86_64-w64-mingw32-cpp ... 50929 2018-01-15 12:50 information.turtle ... --------- ------- 315748394 327 files We can see that each volume has a unique URN, and it contains a file called &ldquo;information.</description>
|
||||
</item>
|
||||
|
||||
<item>
|
||||
<title>Extracting streams from AFF4 volumes</title>
|
||||
<link>https://winpmem.velocidex.com/docs/extracting/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/extracting/</guid>
|
||||
<description>Analysis tools which already support AFF4 will be able to use the AFF4 image directly, but sometimes you may come across a tool which does not. In this case you will want to extract the RAW streams out of the AFF4 volume.
|
||||
To extract streams from an AFF4 volume we use the -e flag.
|
||||
Extract streams by using wild cards WinPmem.exe -e &#39;*/kallsyms&#39; --export_dir /tmp/export/ /tmp/test.aff4 By default export directory is the current directory.</description>
|
||||
</item>
|
||||
|
||||
</channel>
|
||||
</rss>
|
||||
|
||||
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
|
||||
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
|
||||
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="/" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
|
||||
+7
-9
@@ -11,8 +11,8 @@
|
||||
<meta name="description" content="WinPmem memory imager." />
|
||||
<meta property="og:title" content="WinPmem memory imager" />
|
||||
<meta property="og:type" content="website" />
|
||||
<meta property="og:url" content="https://github.com/Velocidex/c-aff4" />
|
||||
<meta property="og:image" content="http://www.aff4.org/img/AFF4.png" />
|
||||
<meta property="og:url" content="https://github.com/Velocidex/WinPmem" />
|
||||
<meta property="og:image" content="" />
|
||||
<meta property="og:description" content="The WinPmem suite of memory acquisition tools support Windows, macOS and Linux." />
|
||||
<meta name="twitter:card" content="" />
|
||||
<meta name="twitter:site" content="" />
|
||||
@@ -47,7 +47,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -58,10 +58,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -80,7 +80,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -98,8 +98,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -118,7 +116,7 @@ include WinPmem, OSXPmem and LinPmem.</p>
|
||||
<a class="button button-primary mb-2" href="/docs">
|
||||
Read the Docs.
|
||||
</a>
|
||||
<a class="button button-primary mb-2" href="https://github.com/Velocidex/c-aff4/releases">
|
||||
<a class="button button-primary mb-2" href="https://github.com/Velocidex/WinPmem/releases">
|
||||
Download the release
|
||||
</a>
|
||||
|
||||
|
||||
@@ -6,56 +6,5 @@
|
||||
<description>Recent content in The Pmem Suite on WinPmem memory imager</description>
|
||||
<generator>Hugo -- gohugo.io</generator>
|
||||
<language>en-us</language><atom:link href="https://winpmem.velocidex.com/index.xml" rel="self" type="application/rss+xml" />
|
||||
<item>
|
||||
<title>Overview</title>
|
||||
<link>https://winpmem.velocidex.com/docs/usage/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/usage/</guid>
|
||||
<description>WinPmem is developed as part of the AFF4 imager project. AFF4 is an advanced, open forensic imaging format. The format has been standardized in the AFF4 Standard Specification, and it is increasing more supported by other tools.
|
||||
WinPmem by default will use AFF4 to store the memory image, but it is also possible to write the image in RAW format or ELF format. You might want to do this if you are going to use the image with tools that can not read AFF4 natively.</description>
|
||||
</item>
|
||||
|
||||
<item>
|
||||
<title>Acquiring Memory</title>
|
||||
<link>https://winpmem.velocidex.com/docs/memory/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/memory/</guid>
|
||||
<description>Acquiring memory using WinPmem is a very simple process:
|
||||
F:\&gt;winpmem.exe -o test.aff4 -dd 2019-05-17 02:26:22 I This is The WinPmem memory imager. version 3.3rc1 2019-05-17 02:26:22 I Extracted 45368 bytes into C:\Users\test\AppData\Local\Temp\pmeB5CC.tmp 2019-05-17 02:26:22 I Driver Unloaded. 2019-05-17 02:26:22 I Loaded Driver C:\Users\test\AppData\Local\Temp\pmeB5CC.tmp 2019-05-17 02:26:22 I Setting acquisition mode 2 2019-05-17 02:26:22 I CR3: 0x00001AA000 5 memory ranges: Start 0x00001000 - Length 0x0009E000 Start 0x00100000 - Length 0x00002000 Start 0x00103000 - Length 0xBFDDD000 Start 0xBFF00000 - Length 0x00100000 Start 0x100000000 - Length 0x52400000 2019-05-17 02:26:22 W Output file test.</description>
|
||||
</item>
|
||||
|
||||
<item>
|
||||
<title>Acquiring Files</title>
|
||||
<link>https://winpmem.velocidex.com/docs/files/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/files/</guid>
|
||||
<description>The WinPmem imager can also acquire multiple files into the AFF4 volume. These can be devices (such as disks using /dev/sda) or logical files.
|
||||
Acquiring a disk image WinPmem.exe -i \\.\c: -o output.aff4 -dd Note that by default the aff4 imager will append new streams to the output volume if it already exists. This is useful for appending more relevant evidence after the initial acquisition is completed. If you dont want this behaviour you can specify the -t (&ndash;truncate) flag to truncate the output volume before adding the new stream.</description>
|
||||
</item>
|
||||
|
||||
<item>
|
||||
<title>Inspecting AFF4 volumes</title>
|
||||
<link>https://winpmem.velocidex.com/docs/inspecting/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/inspecting/</guid>
|
||||
<description>AFF4 volumes are based around the common Zip compression standard (for large volumes we use Zip64 extensions). Therefore it is possible to examine AFF4 volumes using common zip utilities.
|
||||
⟫ unzip -l /tmp/test.aff4 Archive: /tmp/test.aff4 aff4://c7c60030-cc3e-43a6-b5d1-1551b29c9918 Length Date Time Name --------- ---------- ----- ---- 189432 2018-01-15 12:50 usr/bin/mksquashfs 951952 2018-01-15 12:50 usr/bin/x86_64-w64-mingw32-cpp ... 50929 2018-01-15 12:50 information.turtle ... --------- ------- 315748394 327 files We can see that each volume has a unique URN, and it contains a file called &ldquo;information.</description>
|
||||
</item>
|
||||
|
||||
<item>
|
||||
<title>Extracting streams from AFF4 volumes</title>
|
||||
<link>https://winpmem.velocidex.com/docs/extracting/</link>
|
||||
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
|
||||
|
||||
<guid>https://winpmem.velocidex.com/docs/extracting/</guid>
|
||||
<description>Analysis tools which already support AFF4 will be able to use the AFF4 image directly, but sometimes you may come across a tool which does not. In this case you will want to extract the RAW streams out of the AFF4 volume.
|
||||
To extract streams from an AFF4 volume we use the -e flag.
|
||||
Extract streams by using wild cards WinPmem.exe -e &#39;*/kallsyms&#39; --export_dir /tmp/export/ /tmp/test.aff4 By default export directory is the current directory.</description>
|
||||
</item>
|
||||
|
||||
</channel>
|
||||
</rss>
|
||||
|
||||
@@ -2,30 +2,10 @@
|
||||
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
|
||||
xmlns:xhtml="http://www.w3.org/1999/xhtml">
|
||||
|
||||
<url>
|
||||
<loc>https://winpmem.velocidex.com/docs/usage/</loc>
|
||||
</url>
|
||||
|
||||
<url>
|
||||
<loc>https://winpmem.velocidex.com/docs/</loc>
|
||||
</url>
|
||||
|
||||
<url>
|
||||
<loc>https://winpmem.velocidex.com/docs/memory/</loc>
|
||||
</url>
|
||||
|
||||
<url>
|
||||
<loc>https://winpmem.velocidex.com/docs/files/</loc>
|
||||
</url>
|
||||
|
||||
<url>
|
||||
<loc>https://winpmem.velocidex.com/docs/inspecting/</loc>
|
||||
</url>
|
||||
|
||||
<url>
|
||||
<loc>https://winpmem.velocidex.com/docs/extracting/</loc>
|
||||
</url>
|
||||
|
||||
<url>
|
||||
<loc>https://winpmem.velocidex.com/categories/</loc>
|
||||
</url>
|
||||
|
||||
@@ -36,7 +36,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,10 +47,10 @@
|
||||
<div class='header'>
|
||||
<div class="container">
|
||||
<div class="logo">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div class="logo-mobile">
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="http://www.aff4.org/img/AFF4.png" /></a>
|
||||
<a href="https://winpmem.velocidex.com/"><img alt="Logo" src="https://avatars1.githubusercontent.com/u/36671444?s=200" /></a>
|
||||
</div>
|
||||
<div id="main-menu" class="main-menu">
|
||||
<ul>
|
||||
@@ -69,7 +69,7 @@
|
||||
</li>
|
||||
|
||||
<li class="menu-item-github">
|
||||
<a href="https://github.com/Velocidex/c-aff4">
|
||||
<a href="https://github.com/Velocidex/WinPmem">
|
||||
<span>Github</span>
|
||||
</a>
|
||||
</li>
|
||||
@@ -87,8 +87,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
+3
-1
@@ -1,2 +1,4 @@
|
||||
Release
|
||||
.vs
|
||||
.vs
|
||||
*.sln
|
||||
*.user
|
||||
@@ -1,22 +0,0 @@
|
||||
====================
|
||||
PW for zip: betatest
|
||||
====================
|
||||
|
||||
and don't forget to set the testsigning on (and reboot).
|
||||
|
||||
Known issues:
|
||||
* iospace method on Hyper-V VM using the latest Win10 build (but not old Win10 builds) will fail. The other methods should work. Iospace method should work on latest Win10 on machines with no Hyper-V layer.
|
||||
* PTE works only for x64, not x86.
|
||||
* Microsoft bug/glitch: on Hyper-V, the longer a VM runs with the "Dynamic memory" feature enabled, the more fragmentation occurs on the memory range runs. (Up to a thousands).
|
||||
|
||||
Works:
|
||||
* everything else.
|
||||
|
||||
Report as issue:
|
||||
* All glitches and bugs not already listed (but not caring about Python yet).
|
||||
|
||||
WARNING: do not use this version in your python projects yet! The interface may change at any moment.
|
||||
|
||||
Reminders:
|
||||
* Don't forget "bcdedit /set testsigning on"
|
||||
* Disable memory compression and use older Win10 builds or Win7 if you intend to load the dump into Volatility 2.
|
||||
Binary file not shown.
Binary file not shown.
Executable → Regular
BIN
Binary file not shown.
Executable → Regular
BIN
Binary file not shown.
Binary file not shown.
|
Before Width: | Height: | Size: 32 KiB |
+4
-5
@@ -19,7 +19,7 @@ pygmentsUseClasses = true
|
||||
|
||||
[[menu.main]]
|
||||
name = "Github"
|
||||
url = "https://github.com/Velocidex/c-aff4"
|
||||
url = "https://github.com/Velocidex/WinPmem"
|
||||
weight = 3
|
||||
|
||||
[params]
|
||||
@@ -27,10 +27,9 @@ pygmentsUseClasses = true
|
||||
meta_description = "WinPmem memory imager."
|
||||
meta_og_title = "WinPmem memory imager"
|
||||
meta_og_type = "website"
|
||||
meta_og_url = "https://github.com/Velocidex/c-aff4"
|
||||
meta_og_image = "http://www.aff4.org/img/AFF4.png"
|
||||
meta_og_url = "https://github.com/Velocidex/WinPmem"
|
||||
meta_og_description = "The WinPmem suite of memory acquisition tools support Windows, macOS and Linux."
|
||||
|
||||
[params.logo]
|
||||
mobile = "http://www.aff4.org/img/AFF4.png"
|
||||
standard = "http://www.aff4.org/img/AFF4.png"
|
||||
mobile = "https://avatars1.githubusercontent.com/u/36671444?s=200"
|
||||
standard = "https://avatars1.githubusercontent.com/u/36671444?s=200"
|
||||
|
||||
@@ -6,4 +6,21 @@ weight: 1
|
||||
|
||||
## Documentation
|
||||
|
||||
This is the winpmem documentation.
|
||||
This is the winpmem documentation.
|
||||
|
||||
We currently release a simple imager which can only write RAW
|
||||
images. Simple run it with the name of the image file:
|
||||
|
||||
`winpmem_mini_x64.exe physmem.raw`
|
||||
|
||||
# Acquisition modes.
|
||||
|
||||
Three acquisition modes are implemented:
|
||||
|
||||
1. PTE remapping mode - this is the default and is the most stable
|
||||
2. MMMapIoSpace mode - uses the MMMapIoSpace kernel API
|
||||
3. PhysicalMemory mode - passes a handle to the tradition `\\.\PhysicalMemory` device.
|
||||
|
||||
# Reporting issues
|
||||
|
||||
There is an issue board at https://github.com/Velocidex/WinPmem/issues
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Extracting streams from AFF4 volumes"
|
||||
draft: false
|
||||
draft: true
|
||||
weight: 5
|
||||
---
|
||||
|
||||
@@ -30,4 +30,4 @@ To extract streams from an AFF4 volume we use the *-e* flag.
|
||||
|
||||
In the above example, we list the streams in the volume, then grep
|
||||
only the executable files, and extract them into the export
|
||||
directory.
|
||||
directory.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Acquiring Files"
|
||||
draft: false
|
||||
draft: true
|
||||
weight: 3
|
||||
---
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Inspecting AFF4 volumes"
|
||||
draft: false
|
||||
draft: true
|
||||
weight: 4
|
||||
---
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Acquiring Memory"
|
||||
draft: false
|
||||
draft: true
|
||||
weight: 2
|
||||
---
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Overview"
|
||||
draft: false
|
||||
draft: true
|
||||
weight: 1
|
||||
---
|
||||
|
||||
|
||||
@@ -31,7 +31,7 @@
|
||||
<a class="button button-primary mb-2" href="/docs">
|
||||
Read the Docs.
|
||||
</a>
|
||||
<a class="button button-primary mb-2" href="https://github.com/Velocidex/c-aff4/releases">
|
||||
<a class="button button-primary mb-2" href="https://github.com/Velocidex/WinPmem/releases">
|
||||
Download the release
|
||||
</a>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user