New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hibernation support for windows 8 / server 2012 #25

Open
iMHLv2 opened this Issue May 25, 2014 · 4 comments

Comments

Projects
None yet
4 participants
@iMHLv2
Contributor

iMHLv2 commented May 25, 2014

No description provided.

@gleeda gleeda self-assigned this May 25, 2014

@gleeda

This comment has been minimized.

Show comment
Hide comment
@gleeda

gleeda Jul 24, 2014

Member

Here's a couple of notes that I found earlier:

FirstTablePage => FirstBootRestorePage
HibrProcPage = 1

Original notes from earlier:

I've figure out a few things for win8 hibernation files, such as the
location of special registers as well as how to find the number of pages
that are written and I've figured out that the FirstBootRestorePage
appears to be the first page that has memory content.  I'm not sure what
FirstKernelRestorePage is, but its value appears to be the next page
outside of the written pages (PerfInfo.PagesWritten) all of which appear
to be zeroed out.  In this case, PerfInfo.PagesWritten contains the
number of pages written, PerfInfo.KernelPagesWritten is 0, so I'm not
sure what makes the kernel pages populate yet.

data does look compressed, but
not with the traditional xpress headers.  I suspect still using xpress though, just from looking at the data

interestingly enough, when the
machine is woken up, the hiberfil.sys file header remains intact
(instead of being zeroed out like before) with a signature of "WAKE".  I
just have to figure out how the runs are saved... i'm not sure, but they
look like they are all in one place towards the beginning.

http://blogs.technet.com/b/askperf/archive/2012/10/28/windows-8-windows-server-2012-the-new-swap-file.aspx

http://www.thewindowsclub.com/hiberfil-pagefile-swapfile-sys-windows

http://helpdeskgeek.com/windows-8/hdg-explains-swapfile-sys-hiberfil-sys-and-pagefile-sys-in-windows-8/

http://www.sevenforums.com/tutorials/220051-hibernate-change-size-hiberfil-sys-file.html

Member

gleeda commented Jul 24, 2014

Here's a couple of notes that I found earlier:

FirstTablePage => FirstBootRestorePage
HibrProcPage = 1

Original notes from earlier:

I've figure out a few things for win8 hibernation files, such as the
location of special registers as well as how to find the number of pages
that are written and I've figured out that the FirstBootRestorePage
appears to be the first page that has memory content.  I'm not sure what
FirstKernelRestorePage is, but its value appears to be the next page
outside of the written pages (PerfInfo.PagesWritten) all of which appear
to be zeroed out.  In this case, PerfInfo.PagesWritten contains the
number of pages written, PerfInfo.KernelPagesWritten is 0, so I'm not
sure what makes the kernel pages populate yet.

data does look compressed, but
not with the traditional xpress headers.  I suspect still using xpress though, just from looking at the data

interestingly enough, when the
machine is woken up, the hiberfil.sys file header remains intact
(instead of being zeroed out like before) with a signature of "WAKE".  I
just have to figure out how the runs are saved... i'm not sure, but they
look like they are all in one place towards the beginning.

http://blogs.technet.com/b/askperf/archive/2012/10/28/windows-8-windows-server-2012-the-new-swap-file.aspx

http://www.thewindowsclub.com/hiberfil-pagefile-swapfile-sys-windows

http://helpdeskgeek.com/windows-8/hdg-explains-swapfile-sys-hiberfil-sys-and-pagefile-sys-in-windows-8/

http://www.sevenforums.com/tutorials/220051-hibernate-change-size-hiberfil-sys-file.html

@iMHLv2 iMHLv2 added this to the 2.4.1 milestone Aug 4, 2014

@gleeda gleeda removed their assignment Aug 19, 2014

@gleeda gleeda modified the milestones: 2.5, 2.4.1 Feb 2, 2015

@gleeda gleeda added Win8 Win10 labels Feb 16, 2016

@nirizr

This comment has been minimized.

Show comment
Hide comment
@nirizr

nirizr Oct 18, 2016

I'm curious to know what's the status of this task. I'm a professional reverse engineer and might be willing to lend a hand with figuring out the new/modified hiberfile.sys format.

I've previously contributed to Volatility with a somewhat similar task (VMWare snapshots) if you consider this something valuable.

nirizr commented Oct 18, 2016

I'm curious to know what's the status of this task. I'm a professional reverse engineer and might be willing to lend a hand with figuring out the new/modified hiberfile.sys format.

I've previously contributed to Volatility with a somewhat similar task (VMWare snapshots) if you consider this something valuable.

@gleeda

This comment has been minimized.

Show comment
Hide comment
@gleeda

gleeda Oct 18, 2016

Member

Hi @nirizr ! As far as I know, no one has looked at it in a while. Please feel free to take a stab at it, if you have time :-)

Member

gleeda commented Oct 18, 2016

Hi @nirizr ! As far as I know, no one has looked at it in a while. Please feel free to take a stab at it, if you have time :-)

@jared703

This comment has been minimized.

Show comment
Hide comment
@jared703

jared703 Oct 18, 2016

Agreed, this would be awesome Nir. Thank you for your contributions for VM
related snapshots. They are extremely valuable to analysts like myself.

On Oct 18, 2016 9:10 AM, "gleeda" notifications@github.com wrote:

Hi @nirizr https://github.com/nirizr ! As far as I know, no one has
looked at it in a while. Please feel free to take a stab at it, if you have
time :-)


You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#25 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ADJiruWBg9dL8VZLAqBWBU0qNdS50Xfyks5q1MVjgaJpZM4B-Ics
.

jared703 commented Oct 18, 2016

Agreed, this would be awesome Nir. Thank you for your contributions for VM
related snapshots. They are extremely valuable to analysts like myself.

On Oct 18, 2016 9:10 AM, "gleeda" notifications@github.com wrote:

Hi @nirizr https://github.com/nirizr ! As far as I know, no one has
looked at it in a while. Please feel free to take a stab at it, if you have
time :-)


You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#25 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ADJiruWBg9dL8VZLAqBWBU0qNdS50Xfyks5q1MVjgaJpZM4B-Ics
.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment