How to properly run Windows.Memory.Acquisition artifact

[andrew-sa]

Dear community,
I tried to execute the above artifact on a Windows client, but I recived the following message:

Windows.Memory.Acquisition: Skipping query due to preconditions

So I created a custom artifact deleting the line AND version(function='winpmem') >= 0 from preconditions. As a result I recived the following error:

Symbol winpmem not found. Current Scope is [NULL], [_SessionId, $responder, ServiceName, Compression, $device_manager, config, $acl, $uploader, Artifact, $repository, $root], [precondition_Custom_Windows_Memory_Acquisition_0], [Tempfile]

It seems that WinPmem tool is not present on the client. Despite the artifact description says "Acquires a full memory image using the built in WinPmem driver.", do I have to upload WinPmem tool on the client using Artifact.Generic.Utils.FetchBinary?

[scudette]

It looks like your client version is too old relative to your server - you need to use https://docs.velociraptor.app/artifact_references/pages/server.import.previousreleases/ to download older versions of the artifacts that correspond to the old client version.

[andrew-sa]

@scudette
As you suggested I aligned the client version to the server one. Now it recognizes the tool.
However we're facing another problem. When it tries to start the winpmem service, we receive the following message:

2025-02-13T13:56:09Z |   |   |   | Installing driver from C:\Program Files\Velociraptor\Tools\375448976.sys |  
2025-02-13T13:56:09Z |   | INFO |   | winpmem: Creating service winpmem |  
2025-02-13T13:56:09Z |   | INFO |   | winpmem: Installed service winpmem |  
2025-02-13T13:56:09Z |   |   |   | winpmem: could not start service: The filename, directory name or volume name syntax is incorrect.

[scudette]

If you are using an older version of Velociraptor it is probably pushing the winpmem binary. Current version have winpmem integrated in Velociraptor so there is no need to push an external binary.

You can try to use the latest winpmem release which is the go version:

https://github.com/Velocidex/WinPmem/releases

go-winpmem-4.1-rc1.exe

Slightly modify that artifact to use the latest version instead (the commandline is a bit different)

name: Custom.Windows.Memory.Acquisition
description: |
  Acquires a full memory image. We download winpmem and use it to
  acquire a full memory image.

  NOTE: This artifact usually transfers a lot of data. You should
  increase the default timeout to allow it to complete.

tools:
  - name: GoWinPmem64
    url: https://github.com/Velocidex/WinPmem/releases/download/v4.0.rc1/go-winpmem_amd64_1.0-rc1.exe
    serve_locally: true

precondition: SELECT OS From info() where OS = 'windows' AND Architecture = "amd64"

sources:
  - query: |
      SELECT * FROM foreach(
          row={
            SELECT OSPath, tempfile(extension=".raw", remove_last=TRUE) AS Tempfile
            FROM Artifact.Generic.Utils.FetchBinary(ToolName="GoWinPmem64")
          },
          query={
            SELECT Stdout, Stderr,
                   if(condition=Complete,
                      then=upload(file=Tempfile, name="PhysicalMemory.raw")) As Upload
            FROM execve(argv=[OSPath, "acquire", "-v", Tempfile], sep="\r\n")
        })

[andrew-sa]

We're using the lastest version of Velociraptor (Release 0.73.3), but we have the above error. So the tool should be already integrated.

[scudette]

I see - some people reported that sometimes there is already an unrelated winpmem service which interfers - can you try to set the service name to something else in the artifact parameters?

[andrew-sa]

I still recive the same message:

2025-02-13T14:46:41Z |   | INFO |   | Starting query execution for Windows.Memory.Acquisition. |  
2025-02-13T14:46:41Z |   |   |   | Installing driver from C:\Program Files\Velociraptor\Tools\1608615395.sys |  
2025-02-13T14:46:41Z |   | INFO |   | winpmem: Creating service testpmem |  
2025-02-13T14:46:41Z |   | INFO |   | winpmem: Installed service testpmem |  
2025-02-13T14:46:41Z |   |   |   | winpmem: could not start service: The filename, directory name or volume name syntax is incorrect. |  
2025-02-13T14:46:41Z |   |   |   | Uploading 0 bytes |  
2025-02-13T14:46:41Z |   |   |   | Windows.Memory.Acquisition: Time 0: Windows.Memory.Acquisition: Sending response part 0 309 B (1 rows). |  
2025-02-13T14:46:41Z |   |   |   | Windows.Memory.Acquisition: Uploaded 1 files. |  
2025-02-13T14:46:41Z |   | INFO |   | Collection Windows.Memory.Acquisition is done after 129.2236ms |  
2025-02-13T14:46:41Z |   |   |   | tempfile: removing tempfile C:\Program Files\Velociraptor\Tools\tmp903649527.pmem
2025-02-13T14:46:41Z |   | DEBUG |   | Query Stats: {"RowsScanned":4,"PluginsCalled":4,"FunctionsCalled":6,"ProtocolSearch":4,"ScopeCopy":16}

[scudette]

It may not be possible to load the winpmem driver on this system for some reason - maybe there is security software blocking it? Some systems we know Winpmem does not work on (if memory ranges are very fragmented for example)

We rarely use memory acquisition in real life as it is not very useful. Perhaps try another memory acquisition tool?