diff --git a/README.md b/README.md index e393dd3..2b668cf 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,6 @@ Winpmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project, but has recently been separated into its own repository. - ## Copyright This code was originally developed within Google but was released @@ -16,9 +15,9 @@ Winpmem is a physical memory imager with the following features: - Open source -- Support for WinXP - Win 10, x86 + x64. The WDK7600 can be used to +- Support for WinXP - Win 10, x86 + x64. The WDK7600 can be used to include WinXP support. - As default, the provided Winpmem executables will be compiled with WDK10, + As default, the provided Winpmem executables will be compiled with WDK10, supporting Win7 - Win10, and featuring more modern code. - Three different independent methods to create a memory dump. @@ -36,75 +35,77 @@ are available under the following license: Apache License, Version 2.0 ### How to use -There are two winpmem executables: winpmem.exe and winpmem64.exe. -Both versions contain both drivers (32 and 64 bit versions). It does -not matter which version is invoked, it will choose the right driver anyway. - -(Winpmem64.exe can be used in a special environment with no WOW64 emulation -support (such as WINPE) and/or the need for the native bitness.) - -The python program is currently under construction. +There are two winpmem executables: winpmem_mini_x86.exe and winpmem_mini_x64.exe. +Both versions contain both drivers (32 and 64 bit versions). +The mini in the binary name refers to this imager being a plain simple +imager - it can only produce images in RAW format. In the past we +release a WinPmem imager based on AFF4 but that one is yet to be updated to the new driver. Please let us know if you need the AFF4 based imager. ### The Python acquitision tool winpmem.py -Under construction by Scudette. - +The python program is currently under construction but works as a demonstration for how one can use the imager from Python. - -### winpmem.exe (standalone executable) +### winpmem_mini_x64.exe (standalone executable) This program is easiest to use for incident response since it requires no other dependencies than the executable itself. The program will load the correct driver (32 bit or 64 bit) automatically and is self-contained. -NOTE: Currently it is testsigned and needs "bcdedit /set testsigning on" (and reboot). -This a permanent setting. Use "bcdedit /set testsigning off" (and reboot) to switch it off again. - -NOTE: Do not forget to invoke winpmem as admin/elevated! - ##### Examples: -winpmem.exe physmem.raw +`winpmem_mini_x64.exe physmem.raw` Writes a raw image to physmem.raw using the default method of acquisition. -winpmem.exe +`winpmem_mini_x64.exe` Invokes the usage print / short manual. To acquire a raw image using specifically the MmMapIoSpace method: -winpmem.exe -1 myimage.raw +`winpmem.exe -1 myimage.raw` The driver will be automatically unloaded after the image is acquired! - - Experimental write support -------------------------- -The winpmem drivers support writing to memory as well as reading. +The winpmem source code supports writing to memory as well as reading. This capability is a great learning tool since many rootkit hiding -techniques can be emulated by writing to memory directly. +techniques can be emulated by writing to memory directly. This functionality should be used with extreme caution! -NOTE: Since this is a rather dangerous capability, the signed binary drivers -have write support disabled. The unsigned binaries (really self signed with a -test certificate) can not load on a regular system due to them being test self -signed. You can allow the unsigned drivers to be loaded on a test system by -issuing (see +NOTE: Since this is a rather dangerous capability, the signed binary +drivers have write support disabled. You can rebuild the drivers to +produce test signed binaries if you want to use this feature. The +unsigned binaries (really self signed with a test certificate) can not +load on a regular system due to them being test self signed, but you can +allow the unsigned drivers to be loaded on a test system by issuing +(see http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484(v=vs.85).aspx): -Bcdedit.exe -set TESTSIGNING ON +`Bcdedit.exe -set TESTSIGNING ON` and reboot. You will see a small "Test Mode" text on the desktop to remind you that this machine is configured for test signed drivers. Additionally, Write support must also be enabled at load time: -winpmem.exe -w -l +`winpmem.exe -w -l` This will load the drivers and turn on write support. +# Acknowledgments + +This project would also not be possible without support from the wider +DFIR community: + +* We would like to thank Emre Tinaztepe and our other supporters at +[Binalyze](https://binalyze.com/). + +Our open source contributors: + +* Viviane Zwanger +* Mike Cohen diff --git a/docs/404.html b/docs/404.html index 251119a..936ebfd 100644 --- a/docs/404.html +++ b/docs/404.html @@ -36,7 +36,7 @@
  • - + Github
    • @@ -47,10 +47,10 @@
    - Logo + Logo