ArsenalRecon / Arsenal-Image-Mounter

Arsenal Image Mounter mounts the contents of disk images as complete disks in Microsoft Windows.
https://ArsenalRecon.com/weapons/image-mounter
Other
496 stars 85 forks source link

Is it possible to log the mounter driver operation? (aim_ll -a -P not leading to automount) #41

Closed jrmoore closed 8 months ago

jrmoore commented 9 months ago

Hi, I am using the following command line arguments to create a RAM drive that doesn't page to disk -a -f \\?\vhdaccess\??\awealloc\??\C:\Stuff\RAMDisk.vhd -m R:

That template is used and a RAM disk appears at R:\, although a non-fatal error appears most of the time (a cursory look at the source of aim_ll indicates the SetVolumeMountPoint() system call is what leads to it, perhaps some race condition):

C:\Windows\system32>aim_ll -a -f \\?\vhdaccess\??\awealloc\??\C:\Stuff\RAMDisk.vhd -m R: -P
Creating device...
Created device 000100 -> \\?\vhdaccess\??\awealloc\??\C:\Stuff\RAMDisk.vhd
Saving registry settings...
Device is \\?\PhysicalDrive4
Attached disk volume \\?\Volume{ba0c38bf-0000-0000-0000-100000000000}
Error setting volume '\\?\Volume{ba0c38bf-0000-0000-0000-100000000000}\'
mount point to 'R:\': The directory is not empty.
Done.

C:\Windows\system32>echo %errorlevel%
0

The RAM disk VHD template is in a folder any user can access and the file itself is also accessible by anyone:

C:\Windows\system32>icacls C:\Stuff\

C:\Stuff\ BUILTIN\Administrators:(I)(OI)(CI)(F)
          NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
          BUILTIN\Users:(I)(OI)(CI)(RX)
          NT AUTHORITY\Authenticated Users:(I)(M)
          NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)

C:\Windows\system32>icacls C:\Stuff\RAMDisk.vhd

C:\Stuff\RAMDisk.vhd BUILTIN\Administrators:(I)(F)
                     NT AUTHORITY\SYSTEM:(I)(F)
                     BUILTIN\Users:(I)(RX)
                     NT AUTHORITY\Authenticated Users:(I)(M)

The registry entry for the driver seems to be populated correctly, there are 4 new values added to the Parameters key:

image

However, after a system restart the driver isn't automounting the volume, it gets loaded, awealloc as well, but the volume isn't added. I noticed a value named DebugLevel as part of the parameters set to 0xFF and I was wondering if it could be used to troubleshoot why it isn't.

I am using the low level interface, I also looked at the proper AIM program, but it seems not to expose an option to use AWE allocation, I understand the memory can't be prevented from being paged then, and its automount feature doesn't rely on the driver parameters, it seems to be tied to the GUI program executing.

LTRData commented 9 months ago

Yes, unfortunately, the -P switch is not implemented for aim_ll. This is also indicated in the command line help shown with aim_ll --help. I recommend setting up a scheduled task instead that runs your aim_ll command line. I have used that for many years on many different machines and it has always worked perfectly.

Regarding the error with assigning drive letters, I think you have somehow both assigned that driver letter using mount manager using mountvol command line or in Disk Management, and also specified it at aim_ll command line. This is unnecessary and in many cases the drive letter has already been assigned by mount manager in Windows when aim_ll calls to assign it. So, I think you could simply remove -m R: from your command line to avoid this.