4

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is required in newer windows version.

Is there a known way to get around this problem without using a GUI?

4
  • I was trying to do the same and someone pointed me to the usage of the built in Werfault.exe
    – P3nT3ster
    Commented Dec 30, 2015 at 13:30
  • Is this documented anywhere?
    – davidb
    Commented Dec 30, 2015 at 13:47
  • As far as I remember, WinPmem does not require a GUI. Commented Dec 31, 2015 at 1:13
  • Is this a virtual machine? If so, take a snapshot and convert it to a memory image. Another option is to configure the OS to perform a full memory dump and create a BSOD yourself. Commented Jan 2, 2016 at 1:41

1 Answer 1

1

For doing a memory dump, you can use DumpIt and read the dump with volatility.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .