Comments (7)
I hope things will become a little bit better with regards to this in the next release. Also I wish you good luck with your research :)
I'm closing this issue now though.
from memprocfs.
Windows won't let anyone open those files if it's running, or at least I'm not aware of a way. The pagefile options are mostly there to support page files retrieved from virtual machines and such.
But what are you trying to do? What kind of memory are you trying to read that you cannot access? stack, heap, dll/exe-image? If memory is frequently accessed it's not very likely to be paged out to disk.
also, is the problem that you're unable to read the memory completely? or that it's not updating fast enough (i.e. you're reading from the cache instead of live memory)?
from memprocfs.
I'm trying to read sections of a dll however it's inaccessible through pcileech unless I've recently read the memory using a local tool. I've tried reading from the memory bypassing the cache however get the same result. I assumed this must mean the virtual address must not be stored in the physical memory and thus paged to disk.
I'd have assumed if it was a dll it would almost certainly never be paged however this seems to be the case. Because I know for certain this memory region should be non-zero. If it is paged does this mean it is unreadable? Would it be possible to write a kernel implant to move paged memory?
from memprocfs.
the windows memory manager maps the dll into a process page tables on the first use of that page.
the dll in your case is most certainly already existing in memory, but MemProcFS won't read that memory since it's not mapped in the process page tables. I'll fix this in the next version in which it will try to read from the backing virtual address descriptor (VAD) in case of a missing page table entry.
If you wish to recompile you can change this line (for x64)
Line 1306 in f2d15cf
remove
!pte ||
from the if-statement and it should hopefully work.
If that's not working, it may be that it's paged out as well, but the above is the most likely issue. If you decide to go ahead and try the fix can you please let me know if it's working for you.
from memprocfs.
I tried the fix you suggested and sadly it didnt work. Have you got any other suggestions what I could do to access it? Or a place to start on how to read the VAD?
from memprocfs.
You can check out the module files in the "files" folder under in the process directory. It tries to recover the files using different techniques, if any of the files for your module contains your info it will be in the memory.
about info, sadly I don't have any good quick tips to give, and it's quite complex, google is your friend here I'm afraid.
from memprocfs.
Okay thank you! I guess I've got a lot of reading to do.
from memprocfs.
Related Issues (20)
- DEVICE: FAIL: unable to parse elf header MemProcFS: Failed to connect to memory acquisition device. HOT 4
- MemProcFS: Failed to load initial memory map from: '...' HOT 11
- The error return value of the API VMMDLL_Map_GetPteU. HOT 4
- Linux C11 atomics compatibility HOT 5
- Linux GCC/Clang inline semantics HOT 2
- String types const correctness HOT 5
- Can't specify -memmap file HOT 2
- [Not an Issue, just help request] How to find all available "virtual addresses" for process. HOT 2
- MemProcFS C# API: problem with reading file HOT 4
- Minor Typo HOT 2
- Please add -V or -version option HOT 4
- Add check option? HOT 3
- VMMDLL_Map_GetHeapAlloc() VMMDLL_MAP_HEAPALLOCENTRY.cb off by 8 low HOT 3
- Python process.maps.heapalloc() size and memory read issues. HOT 1
- Rust API: VmmYaraResult.result is empty even if VmmYaraResult.total_results>0. HOT 9
- How do you set the interval in the configset vmmdll_opt_refresh HOT 2
- Question: Best way to get findevil results from Rust API HOT 3
- VMMDLL_Initialize init problems on AMD + LINUX HOT 1
- Some Windows 7 memory images cannot analyze dst ip and dst port. HOT 1
- An issue with mounting image files HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from memprocfs.