Commit Graph

31 Commits

Author SHA1 Message Date
Marc André Tanner 1e8ad78386 Signal whether VMK was found by setting process exit status 2025-03-18 20:54:09 +01:00
Marc André Tanner 4e1ac29bbe Update README to mention new command line option 2025-03-18 20:21:20 +01:00
Marc André Tanner 4145aca458 Add -K option to search for a BitLocker VMK 2025-03-18 20:08:58 +01:00
Marc André Tanner 9b7853d330 Fix winpmem utility compilation with MinGW 2025-03-18 20:08:44 +01:00
Viviane 7259a3a5ab Clean code updates, a bug fix, and more ranges (#63)
* Corrected: consistent behavior on the `PHYS_ADDR Out_PhysAddr` out
variable, use MS clean code standard ("always initialize out
variables"). (Thanks for hinting out!)
* Changed kernel boundary check (in Unload) to use the header definition
instead of using an own hardcoded value. (Thanks for hinting out, nicer
this way!)
* Important: goto exit was missing in an error condition in the reverse
query ioctl.
* More Physical Ranges allowed by Winpmem. "300 ought to be enough for
everybody!"
2024-12-01 00:32:19 +10:00
Mike Cohen a1e0b1f5ab Updated go-winpmem to use the latest test driver (#61)
Updated binary to:
1. save function allows to save the actual driver
2. install/uninstall commands allow the driver to be installed and left
in background
2024-11-25 10:10:29 +10:00
Viviane 57f829bc00 Refactor IOCtl, detect L5 paging (#60)
* Refactored device io control.
* Added support for detecting a level 5 paging system. 
* Made DbgPrints (mostly) toggleable again, except critical ones.
* Made Winpmem rogue PTE TLB-uncached (cache disable bit). 
* Improvements on the usermode program bulk reading logic.
* Increased version number to 4.0.1, BETA, for now.

More details about the changes in changelog.md.
2024-11-17 23:34:38 +10:00
Mike Cohen 80f6ecbbeb Install cancellation handler (#58) 2024-07-11 14:11:42 +10:00
Mike Cohen acdf91930e Added inline compression of memory image (#57)
To get good quality memory images it is important to acquire the image
as quickly as possible to avoid smear.

The following algorithms are supported

1. None - no compression
2. S2 - this algorithm gains about 50% compression over none but very
   little loss of speed. The result is slightly faster than none.
3. Snappy - this is a reasonable trade off getting compression
   slightly less than gzip but about twice the time as none.
4. Gzip - This method is very slow and so not recommended but it is
   compatible with the traditional gzip tool

Also added an extract command to convert the compressed images to raw
images later.
2024-07-11 12:02:52 +10:00
Mike Cohen c824d20db4 Added golang implementation for userspace imager (#56)
The old C code is unmaintainable and ancient. A go based images is much
easier to work with going forward and will be supported into the future.
2024-07-10 02:41:43 +10:00
Viviane 4d27adddb8 servicename pmem to winpmem (#54)
Change the service/display name to winpmem.
2024-06-07 22:56:57 +10:00
Viviane 59889475fd Vcxproj update (#52) 2024-06-04 17:22:04 +10:00
Viviane f044f340dd Fix cpu affinity (#51)
When CPU scheduler throws the PTE remap thread of the CPU core n, and later resumes execution on core m, than this can cause issues.

Fixed typo in title and added a limitation section.
2024-05-17 01:41:18 +10:00
Viviane afc9e0633b Winpmem Update (#49)
* Add files via upload

* Delete pci.c

* Delete pci.h

* Delete pte_mmap_windows.c

* Delete pte_mmap_windows.h

* Delete betatest.txt

* Rename CHANGELOG.txt to CHANGELOG.md

* version 3.0.1, sorry for screwing tabs & spaces

* Sorry for screwing the tabs and spaces. Common consent seem to be spaces nowadays, so everything is spaces now. All files end with a line end. 
* Important fixing of several logical checks (some of them leading to a sort of overprotection that disabled methods in Winpmem for no reason). More safeguarding against obvious input mistakes (such as handing over 0 addresses) when using ioctl codes programmatically. This was done after it happened to myself a few times when testing. 
* More sanity checking when trying to restore the rogue pte page. 
* This is almost a total rewrite. My former idea to increase version number to just 2.0.2 is ridiculous. It's 3.0.1 now, and considered an early **alpha** version that might still have bugs. Make no mistake, stability and reliability was significantly increased over the old version.

* update changelog

* update version info

* update version info

* Fix spelling

* bugfixes and large pages for reverse query

* important bugfixes
* large page support added in PTE parsing for reverse query.

* more updates

* minor spelling

* remove duplicate variant2

* Linux x64 Linpmem version, initial

Early version, really please report errors or feature enhancements.

* minor updates

* update readme.md and updates.md

* correct old readme

* Update UPDATES.md

* Minor docs update

* secure boot / signing driver

* Update CHANGELOG.md

* Delete LinPmem directory

Delete Linpmem because it was moved to its own repo (https://github.com/Velocidex/Linpmem).

* Add Linpmem hint.

Add the Linux version hint.
2023-09-11 00:13:36 +10:00
Viviane ac7931f082 Bug fixes! (#41)
* major code refactoring, design changes, bug fixes, documentation

* added FAST I/O read

* Hyper-V/VSM patch, and better icon

* signed pictures with true zw signature

* forgot a condition in iospace read

* package binaries into zip

* updated comments to match usermode part and undelete old signed drivers

* Corrected/updated comments and adjusted status codes

* add a bug and glitches list to keep track

* Delete OPEN_BUGS_AND_GLITCHES.md

* bug fixes

* Better line indent
2022-06-16 14:15:30 +10:00
vletoux 2a7bbd81b6 Add flush to enable streamed output when stdout is connected under a pipe (#34) 2021-07-06 21:48:41 +10:00
vletoux 350f304e29 Enable 32 bits version of winpmem to communicate with x64 driver when run under WoW64 (#36) 2021-07-06 21:48:18 +10:00
Matthias Braun e503038acf Fix spelling in README.md (#23) 2020-12-03 19:42:51 +10:00
Viviane 134441c5fe VSM / Hyper-V securing and some bug fix (and a better icon and logo) (#18) 2020-10-21 22:33:31 +10:00
Mike Cohen 2fc46f83bf Read slowly when buffer error for VSM support. (#14) 2020-10-14 14:39:59 +10:00
Mike Cohen 8b712ab5d2 Prepare for release (#8) 2020-10-12 11:03:49 +10:00
Mike Cohen 8d5981d5e6 Prepare for release. (#7) 2020-10-08 22:18:58 +10:00
Viviane 0ccb8cd38e FAST I/O read (#6)
* major code refactoring, design changes, bug fixes, documentation

* added FAST I/O read
2020-10-08 11:56:01 +10:00
Viviane f58df3f869 major code refactoring, design changes, bug fixes, documentation (#5) 2020-10-06 21:56:39 +10:00
Teleri f856d9a143 Updated Winpmem (Buffered I/O mode) (#3)
* Disapproved but working buffered I/O version.

* increased the version number to reflect possible lack of backward compability

* provide ready-to-use test binaries and instructions for willing beta testers.

* Correction/update of current version information
2020-10-02 14:59:24 +10:00
Mike Cohen f4a21345db Moved documentation site to its own directory and included kernel driver. (#2)
* Moved documentation site to its own directory

* Initial commit of kernel driver code from Rekall.
2020-09-28 22:05:50 +10:00
Michael Cohen 6efea939ef Create CNAME 2019-05-17 23:31:29 +10:00
Michael Cohen 0d1203c54e Merge branch 'master' of https://github.com/Velocidex/WinPmem 2019-05-17 23:30:33 +10:00
Michael Cohen 7a237f7830 Move files to /docs/ 2019-05-17 23:30:06 +10:00
Michael Cohen 8eec36280f Create CNAME 2019-05-17 23:26:30 +10:00
Michael Cohen 7c460096c0 Initial commit of WinPmem site. 2019-05-17 23:24:28 +10:00