Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

issue using winpmem #22

Open
zinebbe opened this issue Nov 24, 2020 · 16 comments
Open

issue using winpmem #22

zinebbe opened this issue Nov 24, 2020 · 16 comments

Comments

@zinebbe
Copy link

zinebbe commented Nov 24, 2020

I am trying to use the pcm (performance counter) and using the winpmem driver.

I have the following error on the event viewer:
The winpmem service failed to start due to the following error:
A device attached to the system is not functioning.

I am using the x64.sys file and storing it in the same directory where I run my pcm.exe

Could you kindly help?

Thanks
@zinebbe zinebbe changed the title issue using wi issue using winpmem Nov 24, 2020
@scudette
Copy link
Contributor

I have no idea what pcm.exe is and what it does? Are you able to load the driver using winpmem.exe -l ?

@zinebbe
Copy link
Author

zinebbe commented Nov 24, 2020 via email

@scudette
Copy link
Contributor

Cool looks like it is working - can you take a memory image?

you can see the driver is installed using sc:

sc.exe query wimpmem

@zinebbe
Copy link
Author

zinebbe commented Nov 24, 2020 via email

@zinebbe
Copy link
Author

zinebbe commented Nov 24, 2020 via email

@scudette
Copy link
Contributor

just run it like winpmem.exe foo.dd

Make sure you use the release binary from the releases page rather than try to build it from source - otherwise you need to sign the driver somehow.

@zinebbe
Copy link
Author

zinebbe commented Nov 24, 2020 via email

@scudette
Copy link
Contributor

image

@zinebbe
Copy link
Author

zinebbe commented Nov 24, 2020 via email

@mhhajeer
Copy link

same problem here. I guess it has to do with write not being enabled. I have tried to enable it by "winpmem.exe -w -l" while running in a test mode, but no luck as it complains of "Failed to set write mode. Maybe these drivers do not support this mode?"

PS: there are also some syntax errors with pmem write enable under read.c PmemWrite line 687 and line 691

@scudette
Copy link
Contributor

scudette commented Apr 25, 2021 via email

@mhhajeer
Copy link

Thanks Mike, I am using this for testing purposes only and I am trying to compile/build a working write enabled driver using the notes in https://github.com/Velocidex/WinPmem/blob/master/README.md . no luck so far with .sys driver or with the .exe tool :(

@scudette
Copy link
Contributor

scudette commented Apr 26, 2021 via email

@mhhajeer
Copy link

Thank you, will give that a shot.
I am getting syntax errors in "read.c PmemWrite line 687 and line 691" when:

  1. uncomment line 33 in winpmem.h #define PMEM_WRITE_ENABLED 1
  2. uncomment line 9 in ctl_codes.h #define PMEM_WRITE_ENABLE CTL_CODE(0x22, 0x102, 0, 3)

Also, after fixing these syntax errors and building the .sys, the service cannot start on windows using this sys for some reason if I try to start with sc.exe

@chadbrewbaker
Copy link

Bump. Could you see why winpmem latest release is failing on windows-latest GitHub worker?

name: TestJob
   on:
       #manually trigger
       workflow_dispatch:

jobs:
    run_win:
        runs-on: windows-latest
        steps:
          -name: Run script
             run: |
               curl -OL URI/winpmem.exe
               ./winpmem.exe dump.raw
               dir

@scudette
Copy link
Contributor

Is this related to this issue? Are you compiling your own driver? If you do you will need to sign it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@chadbrewbaker @scudette @mhhajeer @zinebbe