search

Velocidex / WinPmem

The multi-platform memory acquisition tool.
Apache License 2.0
656 stars 100 forks source link

iospace method never works with Hyper-V [Hyper-V bug] #11

Open vivianezw opened 3 years ago

vivianezw commented 3 years ago

Yet another unfixable Hyper-V bug.

Reading memory using the iospace method will fail if no KD ist attached (no BSOD). There will be a BSOD if KD is attached. It might also BSOD with verifier, since KD and verifier have some similarities (needs verification). Other methods did work.

This is considered a weird error because the outcome depends on whether a kernel debugger is running or not.

Might possibly happen also on barebone machines that have a Hyper-V layer. You get a Hyper-V layer if you enable one of the following: 1.) application guard 2.) the 'discardable' sandbox 3.) Hyper-V Manager 4.) Core isolation 5.) Credential guard (Win10 enterprise only)

vivianezw commented 3 years ago

Definitely related to the VSM bug. Might be able to fix it now after all.

vivianezw commented 3 years ago

Or maybe not. I remember I put a try except block at the iospace method and it did not help. At least not with KD attached. Yes, you read right: the read error happened inside a (ansi c) try statement and it did not help when KD was attached. With KD, there happened a BSOD inside the try statement. Funnily, without KD there was no BSOD, the try statement worked. Still not read data, but okay, we can return zero bytes instead. We'll see soon enough if that works.