I've figure out a few things for win8 hibernation files, such as the
location of special registers as well as how to find the number of pages
that are written and I've figured out that the FirstBootRestorePage
appears to be the first page that has memory content. I'm not sure what
FirstKernelRestorePage is, but its value appears to be the next page
outside of the written pages (PerfInfo.PagesWritten) all of which appear
to be zeroed out. In this case, PerfInfo.PagesWritten contains the
number of pages written, PerfInfo.KernelPagesWritten is 0, so I'm not
sure what makes the kernel pages populate yet.
data does look compressed, but
not with the traditional xpress headers. I suspect still using xpress though, just from looking at the data
interestingly enough, when the
machine is woken up, the hiberfil.sys file header remains intact
(instead of being zeroed out like before) with a signature of "WAKE". I
just have to figure out how the runs are saved... i'm not sure, but they
look like they are all in one place towards the beginning.