winpmem

Documentation

Index

• Constants
• Variables
• func CTL_CODE(device_type, function, method, access uint32) uint32
• func CopyAndLog(ctx context.Context, in io.Reader, out io.Writer, logger Logger) error
• func GetCompressor(name string, w io.Writer) (io.Writer, func(), error)
• func GetDecompressor(header []byte, r io.Reader) (io.Reader, error)
• func InstallDriver(driver_path, service_name string, logger Logger) error
• func UninstallDriver(driver_path, service_name string, logger Logger) error
• func Winpmem_x64() (string, error)
• type Imager
  • func NewImager(device_name string, logger Logger) (*Imager, error)
  • func (self *Imager) Close()
  • func (self *Imager) ReadAt(buf []byte, offset int64) (int, error)
  • func (self *Imager) SetMode(mode PmemMode) error
  • func (self *Imager) SetSparse()
  • func (self *Imager) Stats() *WinpmemInfo
  • func (self *Imager) WriteTo(ctx context.Context, w io.Writer) error
• type LogContext
  • func (self *LogContext) Debug(format string, args ...interface{})
  • func (self *LogContext) Info(format string, args ...interface{})
  • func (self *LogContext) Progress(pages int)
  • func (self *LogContext) SetProgress(pages_per_dot int)
• type Logger
  • func NewLogger(debug bool) Logger
• type PHYSICAL_MEMORY_RANGE
• type PmemMode
• type Run
• type Uint64Hex
  • func (self Uint64Hex) MarshalYAML() (interface{}, error)
• type WINPMEM_MEMORY_INFO_64
  • func (self *WINPMEM_MEMORY_INFO_64) Info() *WinpmemInfo
• type WindowsFile
  • func (self *WindowsFile) Close() error
  • func (self *WindowsFile) Seek(offset int64, whence int) (int64, error)
  • func (self *WindowsFile) Write(buf []byte) (int, error)
• type WinpmemInfo
  • func (self *WinpmemInfo) ToYaml() string
• type WriteSeekCloser
  • func CreateFileForWriting(sparse bool, path string) (WriteSeekCloser, error)

Constants

const (
	NUMBER_OF_RUNS = 20
	PAGE_SIZE      = 0x1000

	BUFSIZE = PAGE_SIZE * 1024 // 4Mb
)

const (
	PMEM_MODE_IOSPACE  = PmemMode(0)
	PMEM_MODE_PHYSICAL = PmemMode(1)
	PMEM_MODE_PTE      = PmemMode(2)
)

Variables

var (
	IOCTL_SET_MODE = CTL_CODE(0x22, 0x101, 3, 3)

	IOCTL_WRITE_ENABLE = CTL_CODE(0x22, 0x102, 3, 3)

	IOCTL_GET_INFO = CTL_CODE(0x22, 0x103, 3, 3)

	IOCTL_REVERSE_SEARCH_QUERY = CTL_CODE(0x22, 0x104, 3, 3)

	YamlFixup = regexp.MustCompile(`"(0x[a-f0-9]+)"`)
)

var (
	SNAPPY = []byte{0xFF, 0x06, 0x00, 0x00, 0x73, 0x4E, 0x61, 0x50, 0x70, 0x59}
	S2     = []byte{0xFF, 0x06, 0x00, 0x00, 0x53, 0x32, 0x73, 0x54, 0x77, 0x4F}
	GZIP   = []byte{0x1F, 0x8B, 0x08}
)

var Winpmem_x64_gz string

Functions

func CTL_CODE

func CTL_CODE(device_type, function, method, access uint32) uint32

func CopyAndLog

func CopyAndLog(
	ctx context.Context, in io.Reader, out io.Writer, logger Logger) error

func GetCompressor

func GetCompressor(name string, w io.Writer) (io.Writer, func(), error)

func GetDecompressor

func GetDecompressor(header []byte, r io.Reader) (io.Reader, error)

func InstallDriver

func InstallDriver(
	driver_path, service_name string,
	logger Logger) error

func UninstallDriver

func UninstallDriver(
	driver_path, service_name string,
	logger Logger) error

func Winpmem_x64

func Winpmem_x64() (string, error)

Types

type Imager

type Imager struct {
	// contains filtered or unexported fields
}

func NewImager

func NewImager(
	device_name string,
	logger Logger) (*Imager, error)

func (*Imager) Close

func (self *Imager) Close()

func (*Imager) ReadAt

func (self *Imager) ReadAt(buf []byte, offset int64) (int, error)

func (*Imager) SetMode

func (self *Imager) SetMode(mode PmemMode) error

func (*Imager) SetSparse

func (self *Imager) SetSparse()

func (*Imager) Stats

func (self *Imager) Stats() *WinpmemInfo

func (*Imager) WriteTo

func (self *Imager) WriteTo(ctx context.Context, w io.Writer) error

type LogContext

type LogContext struct {
	// contains filtered or unexported fields
}

func (*LogContext) Debug

func (self *LogContext) Debug(format string, args ...interface{})

func (*LogContext) Info

func (self *LogContext) Info(format string, args ...interface{})

func (*LogContext) Progress

func (self *LogContext) Progress(pages int)

func (*LogContext) SetProgress

func (self *LogContext) SetProgress(pages_per_dot int)

type Logger

type Logger interface {
	Info(format string, args ...interface{})
	Debug(format string, args ...interface{})

	Progress(pages int)
	SetProgress(pages_per_dot int)
}

func NewLogger

func NewLogger(debug bool) Logger

type PHYSICAL_MEMORY_RANGE

type PHYSICAL_MEMORY_RANGE struct {
	BaseAddress   Uint64Hex `yaml:"BaseAddress"`
	NumberOfBytes Uint64Hex `yaml:"NumberOfBytes"`
}

type PmemMode

type PmemMode uint32

type Run

type Run struct {
	Address int64
	Size    int64
	Sparse  bool
}

type Uint64Hex

type Uint64Hex uint64

func (Uint64Hex) MarshalYAML

func (self Uint64Hex) MarshalYAML() (interface{}, error)

type WINPMEM_MEMORY_INFO_64

type WINPMEM_MEMORY_INFO_64 struct {
	CR3                 uint64
	NtBuildNumber       uint64
	KernelBase          uint64
	KDBG                uint64
	KPCR                [64]uint64
	PfnDataBase         uint64
	PsLoadedModuleList  uint64
	PsActiveProcessHead uint64
	NtBuildNumberAddr   uint64
	Padding             [0xfe]uint64
	NumberOfRuns        uint64
	Run                 [NUMBER_OF_RUNS]PHYSICAL_MEMORY_RANGE
}

func (*WINPMEM_MEMORY_INFO_64) Info

func (self *WINPMEM_MEMORY_INFO_64) Info() *WinpmemInfo

type WindowsFile

type WindowsFile struct {
	// contains filtered or unexported fields
}

func (*WindowsFile) Close

func (self *WindowsFile) Close() error

func (*WindowsFile) Seek

func (self *WindowsFile) Seek(offset int64, whence int) (int64, error)

func (*WindowsFile) Write

func (self *WindowsFile) Write(buf []byte) (int, error)

type WinpmemInfo

type WinpmemInfo struct {
	CR3               Uint64Hex               `yaml:"CR3"`
	NtBuildNumber     Uint64Hex               `yaml:"NtBuildNumber"`
	KernelBase        Uint64Hex               `yaml:"KernelBase"`
	KPCR              []Uint64Hex             `yaml:"KPCR"`
	NtBuildNumberAddr Uint64Hex               `yaml:"NtBuildNumberAddr"`
	Run               []PHYSICAL_MEMORY_RANGE `yaml:"Run"`
}

func (*WinpmemInfo) ToYaml

func (self *WinpmemInfo) ToYaml() string

type WriteSeekCloser

type WriteSeekCloser interface {
	io.Writer
	io.Seeker
	io.Closer
}

func CreateFileForWriting

func CreateFileForWriting(sparse bool, path string) (WriteSeekCloser, error)