The PMEM Memory acquisition suite

Memory acquisition is the first step in memory analysis. Before any analysis can be done, we need to acquire the memory in the first place. There are a number of commercial solutions to acquire memory, but sadly open source solutions have been abandoned or not maintained (For example win32dd has been a popular solution many years ago but has now been commercialized and is no longer open source).

We believe in open source forensic tools to make testing and transparency easier. We also believe that the availability of open source solutions spurs further development in the field and enables choices.

That is the reason we feel an open source, well tested and capable forensic memory acquisition tool is essential - we call it the Pmem suite of tools. The pmem acquisition tool aims to provide a complete imaging solution for Windows, Linux and OSX.

The following is a quick overview of how to use the pmem tools. For detailed information consult the source.

1. WinPmem

The windows memory acquisition tool is called WinPmem.

These are the features it supports:

1. Supports all windows versions from WinXP SP2 to Windows 8 in both i386 and amd64 flavours.
2. Output formats include:
   1. Raw memory images.
   2. Microsoft Crashdump files for use in windbg and volatility.
   3. Output to stdout (in both the above formats) for piping through other tools (e.g. ssh, ewfacquirestream etc).
3. Memory acquisition using
   1. MmMapIoSpace method.
   2. \Device\PhysicalMemory and ZwMapViewOfSection method.
4. Direct analysis of the running kernel using Volatility (Live memory analysis).
5. Optional Write support for manipulating kernel data structures from Volatility.

1.1. Download

The latest version can be found here or on the Volatility download page. You will find the tool released in two versions:

• winpmem-1.3.1.exe: is the recommended binary for general use. This binary contains signed drivers so it can load on any windows system (even 64 bit ones). This binary does not include write support for memory.
• winpmem-1.3.1-write.exe: is the binary with write support enabled. It is not signed so it will only work on 32 bit windows or 64 bit windows with special preparation (see below).

The recommended version for regular use is the one without write support. The version with write support can not be used on a regular system.

c:\..> winpmem_1.3.exe -h
Winpmem - A memory imager for windows.
Copyright Michael Cohen (scudette@gmail.com) 2012.

Version 1.3. Built Nov 12 2012
Usage:
  winpmem_1.3.exe [option] [output path]

Option:
  -l    Load the driver and exit.
  -u    Unload the driver and exit.
  -h    Display this help.
  -w    Turn on/off write mode.
  -1    Use MmMapIoSpace method.
  -2    Use \\Device\PhysicalMemory method (Default).
  -d    Produce a crashdump file.


NOTE: an output filename of - will write the image to STDOUT.

1.2. Examples

Writes a raw image to physmem.raw

winpmem_1.3.exe physmem.raw

Writes a crashdump file to netcat for network transport. Output is supressed here because STDOUT is redirected.

winpmem_1.3.exe -d - | nc 192.168.1.1 80

Normally the driver will be automatically unloaded after the image is acquired. To allow volatility to attach to the raw device for live analysis, we need to load the driver and exit:

c:\..> winpmem.exe -l
Loaded Driver.
c:\..> vol.py -f \\.\pmem

Only the tech preview volatility version is able to open the raw device. In the tech preview version there is no need to specify a profile, since it is autodetected.

To unload the driver and exit:

c:\..> winpmem.exe -u
Driver Unloaded.

To acquire a raw image using the MmMapIoSpace method:

c:\..> winpmem_1.3.exe -1 myimage.raw

To acquire an image in crashdump format:

c:\..>winpmem_1.3.exe -d c:\temp\test.dmp
Driver Unloaded.
Loaded Driver C:\Users\mic\AppData\Local\Temp\win6C6.tmp.
Will write a crash dump file
CR3: 0x0000187000
 2 memory ranges:
Start 0x00001000 - Length 0x0009E000
Start 0x00100000 - Length 0x6F6FB000


00% 0x00001000 .

00% 0x00100000 ..................................................
02% 0x03300000 ..................................................
05% 0x06500000 ..................................................
...
92% 0x67300000 ..................................................
95% 0x6A500000 ..................................................
98% 0x6D700000 .................................
Driver Unloaded.

1.3. Experimental write support

As from Version 1.1, the winpmem drivers support writing to memory as well as reading. This capability is a great learning tool since many rootkit hiding techniques can be emulated by writing to memory directly. For example the following Volatility session illustrates changing the name of the binary:

c:..> vol.py -f \\.\pmem

WinXPSP2x86:pmem 03:10:40> task = session.profile._EPROCESS(0x82079c18)
WinXPSP2x86:pmem 03:10:57> task.ImageFileName
                    Out    [String:ImageFileName]: 'cmd.exe\x00'
WinXPSP2x86:pmem 03:11:15> task.ImageFileName = "foo.exe\x00"
WinXPSP2x86:pmem 03:11:21> task.ImageFileName
                    Out    [String:ImageFileName]: 'foo.exe\x00'

Since this is a rather dangerous capability, the signed binary drivers have write support disabled. The unsigned binaries (really self signed with a test certificate) can not load on a regular system due to them being test self signed. You can allow the unsigned drivers to be loaded on a test system by issuing (seehttp://msdn.microsoft.com/en-us/library/windows/hardware/ff553484(v=vs.85).aspx):

Bcdedit.exe -set TESTSIGNING ON

and reboot. You will see a small "Test Mode" text on the desktop to remind you that this machine is configured for test signed drivers.

Alternatively you can test this on XP or Vista32 which have no driver signing restrictions.

Once the correct driver is loaded, Write support must also be enabled at load time using the -w switch:

winpmem_1.3-write.exe -w -l

This will load the drivers and turn on write support. Then we can run volatility interactively, as usual on the raw device:

vol.exe --profile Win7SP1x64 --file \\.\pmem