-
Notifications
You must be signed in to change notification settings - Fork 1
/
WinPmem.mkape
25 lines (24 loc) · 1.06 KB
/
WinPmem.mkape
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
Description: WinPmem Memory Dump
Category: Memory
Author: Eric Capuano
Version: 3.0
Id: 1d284835-417b-459e-a396-d228edea3808
BinaryUrl: https://github.com/Velocidex/c-aff4/releases/download/3.2/winpmem_3.2.exe
ExportFormat: dmp
Processors:
-
Executable: winpmem.exe
CommandLine: "%destinationDirectory%\\memory.raw"
ExportFormat: raw
# Documentation
# https://winpmem.velocidex.com/
# https://github.com/Velocidex/WinPmem
# 1. Download winpmem_3.2.exe using the link above; also tested with winpmem_3.3.rc1.exe. Other versions may work, but are untested.
# 2. Rename the binary to winpmem.exe (dropping the version number)
# 3. Place the binary into '<KAPE_working_directory>/Modules/bin'
# KAPE should now be able to find the executable at '<KAPE_working_directory>/Modules/bin/winpmem.exe'
#
# To obtain a compressed AFF4 memory dump, swap `--format raw` for `--format map` in the command line parameter above.
#
# Example usage:
# .\kape.exe --tsource C --target EventLogs --tdest "C:\temp\tdest" --module WinPmem --mdest "C:\temp\mdest" --mflush --tflush