{"id":13599150,"url":"https://github.com/Velocidex/WinPmem","last_synced_at":"2025-04-10T12:31:39.379Z","repository":{"id":37828664,"uuid":"187150358","full_name":"Velocidex/WinPmem","owner":"Velocidex","description":"The multi-platform memory acquisition tool.","archived":false,"fork":false,"pushed_at":"2024-07-11T04:11:44.000Z","size":2757,"stargazers_count":647,"open_issues_count":24,"forks_count":99,"subscribers_count":25,"default_branch":"master","last_synced_at":"2024-08-02T17:36:12.218Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Velocidex.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-05-17T05:10:59.000Z","updated_at":"2024-08-02T02:06:37.000Z","dependencies_parsed_at":"2023-01-21T13:20:03.209Z","dependency_job_id":"4844dc11-9095-4547-92c3-dcb0773f715b","html_url":"https://github.com/Velocidex/WinPmem","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Velocidex%2FWinPmem","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Velocidex%2FWinPmem/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Velocidex%2FWinPmem/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Velocidex%2FWinPmem/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Velocidex","download_url":"https://codeload.github.com/Velocidex/WinPmem/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223437341,"owners_count":17144905,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T17:01:00.273Z","updated_at":"2024-11-07T00:30:52.420Z","avatar_url":"https://github.com/Velocidex.png","language":"C","funding_links":[],"categories":["Other Lists","Tool"],"sub_categories":["🛡️ DFIR:","Memory Acquisition"],"readme":"# WinPmem -- a physical memory acquisition tool\r\n\r\n![alt text](site/figures/128x128/winpmem_with_eye.png \"WinPmem -- a physical memory acquisition tool\")\r\n\r\n**WinPmem** has been the default open source memory acquisition driver for\r\nwindows for a long time. It used to live in the Rekall project, but\r\nhas recently been separated into its own repository.\r\n\r\nThis is the *Windows* version. The *Linux* version, **Linpmem**, is at: [https://github.com/Velocidex/Linpmem](https://github.com/Velocidex/Linpmem)\r\n\r\n## Copyright\r\n\r\nThis code was originally developed within Google but was released\r\nunder the Apache License.\r\n\r\n### Description\r\n\r\nWinPmem is a physical memory acquisition tool with the following features:\r\n\r\n- Open source\r\n\r\n- Support for Win7 - Win 10, x86 + x64. The WDK7600 might be used to\r\n  include WinXP support.\r\n  As default, the provided WinPmem executables will be compiled with WDK10,\r\n  supporting Win7 - Win10, and featuring more modern code.\r\n\r\n- Three independent reading methods, with two methods to create a complete memory dump.\r\n  One method should always work even when faced with kernel mode rootkits.\r\n\r\n- Raw memory dump image support.\r\n\r\n- A read device interface is used instead of writing the image from the kernel\r\n  like some other imagers. This allows us to have complex userspace imager\r\n  (e.g. copy across network, hash etc), as well as run analysis on the live\r\n  system (e.g. can be run directly on the device).\r\n\r\nThe files in this directory (Including the WinPmem sources and signed binaries),\r\nare available under the following license: Apache License, Version 2.0\r\n\r\n### How to use\r\n\r\nThere are two WinPmem executables: winpmem_mini_x86.exe and winpmem_mini_x64.exe.\r\nBoth versions contain both drivers (32 and 64 bit versions).\r\n\r\nThe mini in the binary name refers to this imager being a plain simple\r\nimager - it can only produce images in RAW format. In the past we\r\nrelease a WinPmem imager based on AFF4 but that one is yet to be updated to the new driver. Please let us know if you need the AFF4 based imager.\r\n\r\n### The Python acquisition tool winpmem.py\r\n\r\nThe python program is currently under construction but works as a demonstration for how one can use the imager from Python.\r\n\r\n### winpmem_mini_x64.exe (standalone executable)\r\n\r\nThis program is easiest to use for incident response since it requires no other\r\ndependencies than the executable itself. The program will load the correct\r\ndriver (32 bit or 64 bit) automatically and is self-contained.\r\n\r\n##### Examples:\r\n\r\n`winpmem_mini_x64.exe physmem.raw`\r\n\r\nWrites a raw image to physmem.raw using the default method of acquisition.\r\n\r\n`winpmem_mini_x64.exe`\r\n\r\nInvokes the usage print / short manual.\r\n\r\nTo acquire a raw image using specifically the MmMapIoSpace method:\r\n\r\n`winpmem.exe -1 myimage.raw`\r\n\r\nThe driver will be automatically unloaded after the image is acquired!\r\n\r\n### Limitations\r\n\r\nDue to how Microsoft designed the MJ READ function, reading from physical memory will fail in Winpmem with STATUS_INVALID_PARAMETER if a physical address *larger* than half the maximum value of an UINT64 is specified. E.g., this is true if somebody wants to read in higher parts of the physical memory **and** has a giant physical memory (more than 9,223,372,036,854,775,807). This sounds highly unlikely, but todays RAM sizes continue to increase.\r\n\r\nExperimental write support\r\n--------------------------\r\n\r\nThe WinPmem source code supports writing to memory as well as reading.\r\nThis capability is a great learning tool since many rootkit hiding\r\ntechniques can be emulated by writing to memory directly.\r\n\r\nThis functionality should be used with extreme caution!\r\n\r\nNOTE: Since this is a rather dangerous capability, the signed binary\r\ndrivers have write support disabled. You can rebuild the drivers to\r\nproduce test signed binaries if you want to use this feature. The\r\nunsigned binaries (really self signed with a test certificate) can not\r\nload on a regular system due to them being test self signed, but you can\r\nallow the unsigned drivers to be loaded on a test system by issuing\r\n(see\r\nhttps://docs.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option:\r\n\r\n`Bcdedit.exe -set TESTSIGNING ON`\r\n\r\nand reboot. You will see a small \"Test Mode\" text on the desktop to remind you\r\nthat this machine is configured for test signed drivers.\r\n\r\nAdditionally, Write support must also be enabled at load time:\r\n\r\n`winpmem.exe -w -l`\r\n\r\nThis will load the drivers and turn on write support.\r\n\r\n# Acknowledgments\r\n\r\nWinpmem, as well as Linpmem, would not exist without the work of our predecessors of the (now retired) REKALL project: https://github.com/google/rekall.\r\n\r\nThis project would also not be possible without support from the wider\r\nDFIR community:\r\n\r\n* We would like to thank Emre Tinaztepe and Mehmet GÖKSU at\r\n[Binalyze](https://binalyze.com/).\r\n\r\nOur open source contributors:\r\n\r\n* Viviane Zwanger\r\n* Mike Cohen\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FVelocidex%2FWinPmem","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FVelocidex%2FWinPmem","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FVelocidex%2FWinPmem/lists"}