Memory Imaging - Revision history

Joachim Metz: /* MmMapIoSpace */

2012-07-27T11:24:00Z

‎MmMapIoSpace

2012-07-27T11:23:06Z

‎Reading from the Physical Memory Object

2012-07-27T11:22:48Z

‎MmMapIoSpace

2012-07-27T11:21:25Z

2012-07-27T11:14:56Z

2012-07-27T11:01:37Z

2012-07-27T11:01:13Z

2012-07-27T11:00:41Z

2012-07-27T10:43:26Z

2012-07-27T10:04:34Z

Created page with "{{expand}} Memory imaging is the process of making a bit-by-bit copy of memory, it is similar to Disk Imaging."

New page

{{expand}}

Memory imaging is the process of making a bit-by-bit copy of memory, it is similar to [[Disk Imaging]].

@@ Line 14: / Line 14: @@
 === MmMapIoSpace ===
+The MmMapIoSpace function (or routine) is kernel-mode function to map a physical address range to non-paged system space [http://msdn.microsoft.com/en-us/library/windows/hardware/ff554618(v=vs.85).aspx].
 The MmMapIoSpace function (or routine) is kernel [http://msdn.microsoft.com/en-us/library/windows/hardware/ff554618(v=vs.85).aspx]
 == Also see ==

@@ Line 11: / Line 11: @@
 === Reading from the Physical Memory Object ===
-In [[Windows]] the Physical Memory Object, \\Device\PhysicalMemory, can be used the access physical memory. Since Windows 2003 SP1 user-mode access to this device-object is no longer permitted [http://technet.microsoft.com/en-en/library/cc787565(v=ws.10).aspx]. A kernel-space process is still allowed to read from this device-object.
+In [[Windows]] the Physical Memory Object, \\Device\PhysicalMemory, can be used the access physical memory. Since Windows 2003 SP1 user-mode access to this device-object is no longer permitted [http://technet.microsoft.com/en-en/library/cc787565(v=ws.10).aspx]. A kernel-mode process is still allowed to read from this device-object.
 === MmMapIoSpace ===

@@ Line 15: / Line 15: @@
 === MmMapIoSpace ===
 ...
 == Also see ==

@@ Line 7: / Line 7: @@
 The resulting copy is stored in a [[:Category:Forensics_File_Formats|Forensics image format]].
 Some of these formats have means to differentiate between an image of memory and e.g. that of a disk.
 == Also see ==

@@ Line 2: / Line 2: @@
 Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to [[Disk Imaging]].
 For physical memory it is common to have sections that are not accessible, e.g. because of memory-mapped I/O
 == Also see ==

← Older revision		Revision as of 11:01, 27 July 2012
Line 9:		Line 9:
	== External Links ==		== External Links ==
	* [http://en.wikipedia.org/wiki/Memory-mapped_I/O Wikipedia article on Memory-mapped I/O]		* [http://en.wikipedia.org/wiki/Memory-mapped_I/O Wikipedia article on Memory-mapped I/O]
		+
		+	[[Category:Memory Analysis]]

@@ Line 1: / Line 1: @@
 {{expand}}
-Memory imaging is the process of making a bit-by-bit copy of memory, it is similar to [[Disk Imaging]].
+Memory imaging is the process of making a bit-by-bit copy of memory. In principle it is similar to [[Disk Imaging]].
+For physical memory however it is common to have sections that are not accessible, e.g. because of memory-mapped I/O
 == Also see ==
 [[:Tools:Memory_Imaging|Memory Imaging Tools]]

← Older revision		Revision as of 10:43, 27 July 2012
Line 2:		Line 2:

	Memory imaging is the process of making a bit-by-bit copy of memory, it is similar to [[Disk Imaging]].		Memory imaging is the process of making a bit-by-bit copy of memory, it is similar to [[Disk Imaging]].
		+
		+
		+	== Also see ==
		+	[[:Tools:Memory_Imaging\|Memory Imaging Tools]]