`snapshot`

A Rust WinDbg extension that takes a snapshot of a running VM.

snapshot is a WinDbg extension written in Rust that dumps both the state of a CPU (GPRs, relevant MSRs, FPU state, segments, etc.) and the physical memory of a running VM (via a crash-dump). This snapshot is meant to be used by snapshot-based fuzzers and more particularly by wtf.

This code base is also meant to show case how to write a WinDbg extension in Rust 🦀.

Building

You can build the extension with the below:

c:\>git clone https://github.com/0vercl0k/snapshot.git
c:\>cd snapshot
c:\snapshot>cargo build --release

If you would rather grab a pre-built extension, grab one on the releases page.

Grabbing a snapshot

Once you have the extension downloaded / compiled, you can load it in WinDbg with the below:

kd> .load \path\to\snapshot\target\release\snapshot.dll
kd> !snapshot -h [snapshot] Usage: snapshot [OPTIONS] [STATE_PATH]
Arguments:   [STATE_PATH]  The path to save the snapshot to
Options:   -k, --kind <KIND>  The kind of snapshot to take [default: full] [possible values: active-kernel, full]   -h, --help         Print help

Generate a full-kernel snapshot in the c:\foo directory with the below:

kd> !snapshot c:\foo [snapshot] Dumping the CPU state into c:\foo\state.19041.1.amd64fre.vbrelease.191206-1406.20240205173527\regs.json.. [snapshot] Dumping the memory state into c:\foo\state.19041.1.amd64fre.vbrelease.191206-1406.20240205173527\mem.dmp.. Creating c:\\foo\\state.19041.1.amd64fre.vbrelease.191206-1406.20240205173527\\mem.dmp - Full memory range dump 0% written. 5% written. 1 min 12 sec remaining. 10% written. 1 min 4 sec remaining. [...] 90% written. 6 sec remaining. 95% written. 3 sec remaining. Wrote 4.0 GB in 1 min 11 sec. The average transfer rate was 57.7 MB/s. Dump successfully written [snapshot] Done!

There is also !snapshotactivekernel if you would prefer to grab an active kernel crash-dump.

🔗 More in this category