Skip to content
This repository has been archived by the owner on Oct 18, 2020. It is now read-only.

KernelGetModuleBaseByPtr is rewritten using RtlPcToFileHeader. #544

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

scudette
Copy link
Collaborator

@scudette scudette commented Sep 5, 2020

This should fix a crash on recent windows versions.

This should fix a crash on recent windows versions.
@scudette
Copy link
Collaborator Author

scudette commented Sep 5, 2020

Test signed driver
drivers.zip

@eltms
Copy link

eltms commented Sep 17, 2020

Hello Mike,
I tested the recent drivers downloaded from: https://github.com/google/rekall/files/5178296/drivers.zip

When I ran this command on cmd:
winpmem.py -d bin\winpmem.sys -f foobar.raw

I get this output:
(577, 'StartService', 'Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.'): will try to continue
Traceback (most recent call last):
File "...\winpmem\rekall-KernelGetModuleBaseByPtr\tools\windows\winpmem\winpmem.py", line 258, in
main()
File "...\winpmem\rekall-KernelGetModuleBaseByPtr\tools\windows\winpmem\winpmem.py", line 238, in main
None)
pywintypes.error: (2, 'CreateFile', 'The system cannot find the file specified.')

Any help or suggestion please?
Elty

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
2 participants