Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hibernation support for windows 8 / server 2012 #25

iMHLv2 opened this issue May 25, 2014 · 4 comments

Hibernation support for windows 8 / server 2012 #25

iMHLv2 opened this issue May 25, 2014 · 4 comments


Copy link

iMHLv2 commented May 25, 2014

No description provided.

@gleeda gleeda self-assigned this May 25, 2014
Copy link

gleeda commented Jul 24, 2014

Here's a couple of notes that I found earlier:

FirstTablePage => FirstBootRestorePage
HibrProcPage = 1

Original notes from earlier:

I've figure out a few things for win8 hibernation files, such as the
location of special registers as well as how to find the number of pages
that are written and I've figured out that the FirstBootRestorePage
appears to be the first page that has memory content.  I'm not sure what
FirstKernelRestorePage is, but its value appears to be the next page
outside of the written pages (PerfInfo.PagesWritten) all of which appear
to be zeroed out.  In this case, PerfInfo.PagesWritten contains the
number of pages written, PerfInfo.KernelPagesWritten is 0, so I'm not
sure what makes the kernel pages populate yet.

data does look compressed, but
not with the traditional xpress headers.  I suspect still using xpress though, just from looking at the data

interestingly enough, when the
machine is woken up, the hiberfil.sys file header remains intact
(instead of being zeroed out like before) with a signature of "WAKE".  I
just have to figure out how the runs are saved... i'm not sure, but they
look like they are all in one place towards the beginning.

@iMHLv2 iMHLv2 added this to the 2.4.1 milestone Aug 4, 2014
@gleeda gleeda removed their assignment Aug 19, 2014
@gleeda gleeda modified the milestones: 2.5, 2.4.1 Feb 2, 2015
Copy link

nirizr commented Oct 18, 2016

I'm curious to know what's the status of this task. I'm a professional reverse engineer and might be willing to lend a hand with figuring out the new/modified hiberfile.sys format.

I've previously contributed to Volatility with a somewhat similar task (VMWare snapshots) if you consider this something valuable.

Copy link

gleeda commented Oct 18, 2016

Hi @nirizr ! As far as I know, no one has looked at it in a while. Please feel free to take a stab at it, if you have time :-)

Copy link

jared703 commented Oct 18, 2016

Agreed, this would be awesome Nir. Thank you for your contributions for VM
related snapshots. They are extremely valuable to analysts like myself.

On Oct 18, 2016 9:10 AM, "gleeda" wrote:

Hi @nirizr ! As far as I know, no one has
looked at it in a while. Please feel free to take a stab at it, if you have
time :-)

You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#25 (comment),
or mute the thread

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

4 participants