Editing/Creating minidumps

skelsec / minidump

Python library to parse and read Microsoft minidump file format

MIT License

270 stars 55 forks source link

Editing/Creating minidumps #7

Open s0i37 opened 5 years ago

s0i37 commented 5 years ago

Good day. Please tell me how can I create a minidump with your library from scratch? The live case: I need to create a dump of some virtual memory of some process from physical dump. Volatility/rekall provide just flat memory dump + memory mapping. It is very strange that nowadays we have not any ways for creating minidump with third party libraries (not winapi)

skelsec commented 5 years ago

This sounds like quite some work.

In order to get it done with this library, one would need to at minimum do the following:

implement the serialization (to_bytes) function for Memory64ListStream, MemoryInfoListstream, SystemInfoStream, ModuleListStream, (optionally) ThreadInfoListStream and ThreadListStream
implement an interface which gathers all required information for the aforementioned streams except for the Memory64ListStream and stores them in memory. Then when all side-info is gathered and serialized the file should be constructed which again requires serialization, finally start reading the memory and immediately appending it to said file, so you'll use the minimum amount of memory for the operation.
make this interface as a virtual object, so it can be extendd to support the forensics tool/live system you are using to generate the minidump file
(opt) make an interface for changing already existing minidumps, but that would take even more effort

skelsec commented 5 years ago

Also please note that this is the bare minimum to get something working. The resulting image will not be usable for example debugging purposes, as it will be missing exception info/thread info etc. Also note that currently it is not possible to create something which is fully following the standard, as Microsoft "forgot" to document all stream types...

s0i37 commented 5 years ago

Sounds sad( By the way, a volatility tools can create minidump and moreover this mdmp is could be opened with windbg. But volatility can not support specify another pid which wasn't actived in moment creating full memory dump.

s0i37 commented 5 years ago

May you please tell me are you plaining to implement this in the nearest time? Or ever?

skelsec commented 5 years ago

Yes, it is on the roadmap and I started developing it, however I can't say it for sure when it will be ready. I am aiming for this month.

On 17 Sep 2019, at 17:49, s0i37 notifications@github.com wrote:

May you please tell me are you plaining to implement this in the nearest time? Or ever?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

skelsec commented 4 years ago

@s0i37 I'm making some progress but still not there yet