4

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is required in newer windows version.

Is there a known way to get around this problem without using a GUI?

Improve this question
4
  • I was trying to do the same and someone pointed me to the usage of the built in Werfault.exe
    – P3nT3ster
    Dec 30, 2015 at 13:30
  • Is this documented anywhere?
    – davidb
    Dec 30, 2015 at 13:47
  • As far as I remember, WinPmem does not require a GUI.
    – user2313067
    Dec 31, 2015 at 1:13
  • Is this a virtual machine? If so, take a snapshot and convert it to a memory image. Another option is to configure the OS to perform a full memory dump and create a BSOD yourself.
    – user2320464
    Jan 2, 2016 at 1:41

1 Answer 1

Reset to default
1

For doing a memory dump, you can use DumpIt and read the dump with volatility.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .