search

Velocidex / WinPmem

The multi-platform memory acquisition tool.
Apache License 2.0
669 stars 102 forks source link

can't dump RAM #44

Open cofarmer opened 2 years ago

cofarmer commented 2 years ago

image With DbgView.exe，the value of number_of_runs == 50, so dump ram failed here.

vivianezw commented 2 years ago

https://github.com/Velocidex/WinPmem/issues/10

Dynamic Memory in Hyper-V is enabled? This leads to fragmentation of thousands of memory ranges.

cofarmer commented 2 years ago

Run in VMware 16+

vivianezw commented 2 years ago

You have more than the usual number of runs. You should look into the vmware settings for something causing the behavior, it would have to be something with memory management.

The sanity check limits the number of runs to a current maximum of 20 runs. Typically it would be something around 10. Technically we could afford more, just not 1000 like it happens with HV after a while with dynamic memory on. I suspect a similar mechanism is happening on Vmware. It would be interesting to know how many runs you got in this case (more than 20, for sure :D).