4

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is required in newer windows version.

Is there a known way to get around this problem without using a GUI?

  • I was trying to do the same and someone pointed me to the usage of the built in Werfault.exe – P3nT3ster Dec 30 '15 at 13:30
  • Is this documented anywhere? – davidb Dec 30 '15 at 13:47
  • As far as I remember, WinPmem does not require a GUI. – user2313067 Dec 31 '15 at 1:13
  • Is this a virtual machine? If so, take a snapshot and convert it to a memory image. Another option is to configure the OS to perform a full memory dump and create a BSOD yourself. – user2320464 Jan 2 '16 at 1:41
1

For doing a memory dump, you can use DumpIt and read the dump with volatility.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.