ArsenalRecon / Arsenal-Image-Mounter

Arsenal Image Mounter mounts the contents of disk images as complete disks in Microsoft Windows.
https://ArsenalRecon.com/weapons/image-mounter
Other
531 stars 89 forks source link

vhd work in awe and not as file #31

Closed lollita closed 1 year ago

lollita commented 1 year ago

Why this work fine: aim_ll -a -f \?\vhdaccess\??\awealloc\??\c:\fn.vhd -m Z: and this not? aim_ll -a -t file -f c:\fn.vhd -m Z: "No volumes attached. Disk could be offline or not partitioned."

LTRData commented 1 year ago

Because the Arsenal Image Mounter driver itself does not support VHD file format, so it will mount it as a raw image. Therefore it needs another driver in between to actually parse the VHD file correctly.

lollita commented 1 year ago

There is some way to open it only with AIM, f.e.: aim_ll -a -f \?\vhdaccess??\c:\fn.vhd -m Z: again I read in "Disk Image Support":Virtual Machine Disk Files (VHD, VDI, XVA, VMDK, OVA). Then why the Arsenal Image Mounter driver itself does not support VHD file format?

lollita commented 1 year ago

I tryed also:

devio.exe 9999 c:\fn.vhd 1 1
aim_ll.exe -a -t proxy -o ip -f 127.0.0.1:9999 -m W: -S 512

but get:

The ImDisk Virtual Disk Driver Helper Service is not installed. Please install ImDisk Virtual Disk Driver.

do AIM need again Imdisk?

LTRData commented 1 year ago

Yes, network based proxy directly from the driver is not implemented in AIM, but it can be used if ImDisk is also installed.

I would instead recommend that you use shared memory proxy instead when you have proxy server on the same machine. That does not require ImDisk.

LTRData commented 1 year ago

There is some way to open it only with AIM, f.e.: aim_ll -a -f \?\vhdaccess??\c:\fn.vhd -m Z: again I read in "Disk Image Support":Virtual Machine Disk Files (VHD, VDI, XVA, VMDK, OVA). Then why the Arsenal Image Mounter driver itself does not support VHD file format?

That command line uses a driver called vhdaccess in between that parses the VHD structure.

The paragraph about image file format support covers all image file formats supported by Arsenal Image Mounter application. Most of that is not implemented in the driver, it is part of the .NET based API for Arsenal Image Mounter. If you want to mount such images at command line, you could use the aim_cli command line tool which is .NET and provides these features for command line use.

LTRData commented 1 year ago

There is some way to open it only with AIM, f.e.: aim_ll -a -f \?\vhdaccess??\c:\fn.vhd -m Z: again I read in "Disk Image Support":Virtual Machine Disk Files (VHD, VDI, XVA, VMDK, OVA). Then why the Arsenal Image Mounter driver itself does not support VHD file format?

Your command line should be: aim_ll -a -f \\?\vhdaccess\??\c:\fn.vhd -m Z:

lollita commented 1 year ago

aim_ll -a -f \\?\vhdaccess\??\c:\fn.vhd -m Z: work fine.

devio.exe shm:test1 c:\fn.vhd
aim_ll.exe -a -t proxy -o shm -f test1

not work: No volumes attached. Disk could be offline or not partitioned.

I switced from ImDisk to AIM. Great job with aim_ll.exe. Ty.

LTRData commented 1 year ago

devio.exe shm:test1 c:\fn.vhd aim_ll.exe -a -t proxy -o shm -f test1



not work: _No volumes attached. Disk could be offline or not partitioned._

You need to add 0 to the devio command line when using it with AIM. The reason is that devio by default works with a single partition, not the whole image. Since AIM is a full-disk emulator, devio needs to expose the entire disk instead of a single partition: devio.exe shm:test1 c:\fn.vhd 0

I switced from ImDisk to AIM. Great job with aim_ll.exe. Ty.

Thanks!