search

Velocidex / WinPmem

The multi-platform memory acquisition tool.
Apache License 2.0
695 stars 102 forks source link

Need a signed driver of the fixed WinPmem version #20

Open rs-develop opened 4 years ago

rs-develop commented 4 years ago

Hello,

is a time sheduled when a signed driver of the fixed WinPmem version will be available?

Thank you!

scudette commented 4 years ago

It is available in this repository and embedded in the rc2 from the releases.

vivianezw commented 4 years ago

Well, I have the feeling he meant "with all methods fixed, not just PTE". :)

The current code base is not a good candidate for signing, because some things are still on the todo list, mostly a more precise error feedback back to the usermodemode component to differentiate between VSM errors (pseudo errors) or real errors. Chance is that I don't find time before February - April (the deadline before Microsoft makes signing forever impossible). There is a chance that there will never be a fixed signed driver because it's, simply spoken, not important enough. ;-p

scudette commented 4 years ago

I dont see the benefit of differentiating between VSM errors and "real errors" (I dont actually know what a real error is and how to tell we had one :-).

I do not see the benefit in implementing 32 bit PTE remapping - on 32 bit systems existing APIs work sufficiently well (no patchguard anyway).

All the bug fixes are currently in the userspace code and they seem pretty minor (so far just better defaults and refusing to run in unsupported configurations like running the 32 bit binary on 64 bit systems). I am not planning on implementing any kernel mode code unless a bug arises.