search

ArsenalRecon / Arsenal-Image-Mounter

Arsenal Image Mounter mounts the contents of disk images as complete disks in Microsoft Windows.
https://ArsenalRecon.com/weapons/image-mounter
Other
496 stars 85 forks source link

Arsenal-Image-Mounter does not work together with virtio disk. #11

Closed zzambers closed 4 years ago

zzambers commented 4 years ago

Hi, I found that Arsenal-Image-Mounter does not work in qemu VM, if there is a disk, using virtio drivers [1].

Command tested: aim_ll.exe -a -s 8G -m R: -p "/fs:ntfs /q /y" Wrong version of Arsenal Image Mounter.

(in reality, version is indeed correct one)

I think problem is that both drivers create device \Device\RaidPortN and Arsenal-Image-Mounter chooses wrong one [2]. Program than later fails on driver version check [3].

[1] https://www.linux-kvm.org/page/WindowsGuestDrivers/Download_Drivers [2] https://github.com/ArsenalRecon/Arsenal-Image-Mounter/blob/master/Unmanaged%20Source/aimapi/aimapi.cpp#L152 [3] https://github.com/ArsenalRecon/Arsenal-Image-Mounter/blob/33d0f221c76b81d5956b596eb0bd84eec69de616/Unmanaged%20Source/aim_ll/aimcmd.cpp#L456

LTRData commented 4 years ago

Really strange. It should not really pick the wrong RaidPort device since we do a check for miniport signature using an IOCTL_SCSI_MINIPORT call and only if that is successful we pick that device. The miniport signature we check for is "PhDskMnt". Not really sure why virtio drivers would respond "okay" to a request with that signature, if this is what happens.

zzambers commented 4 years ago

That was only my guess, based on my quick experiment. It is possible, that I am wrong. (I don't have experience with windows driver development. ) Anyway if I change HDD from virtio to SATA problem goes away.

LTRData commented 4 years ago

Okay, just trying to figure out how this could happen. Thanks for your report!

zzambers commented 4 years ago

I was eventually able to workaround this issue by modifying source code of aimapi.dll [1].

I basically added code for checking driver version into loop in ImScsiOpenScsiAdapter function. Then after I built it and replaced original aimapi.dll with my custom one, issue was gone. ( It (aim_ll.exe) now works together with virtio disk. )

I also made my workarounded aimapi.dll available in my fork ([2] 64bit, for current AIM version), in case someone would find it useful.

[1] https://github.com/zzambers/Arsenal-Image-Mounter/commit/15e1aafafa4a3293ab5a9c49959cd2da6b0b4a14 [2] https://github.com/zzambers/Arsenal-Image-Mounter/releases

LTRData commented 4 years ago

Thanks a lot for your contribution! We'll include this in next release!

zzambers commented 4 years ago

Thank you!