| Description | Wishlist | Status | Samples | Bugs to fix | FAQ | Contacts |
Project description [UP]
- Sandman is a C Library that aims to read the hibernation file, regardless of Windows version. Thus, it makes possible to do forensics live analysis on the dumped file.
- 2008-10-08
1.1.1.20081008: Minor bugs fixed in xpress compression algorithm.
- 2008-04-08
1.1.20080804: Xpress algorithm reimplemented, including compression and decompression.
As I highlighted to X-Ways people, the previous version was unstable and bugged.
- 2008-26-02 SandMan Framework: 1.0.080226 alpha SandMan is out!
* Only 32bits version of hiberfil.sys from Windows XP to Windows 2008 Server are supported yet.
* SandMan Framework provides a C library and a Python portage
* SandMan is open-source and under GPL3 licence.
Prerequisite to run the sample app. (Thanks Aaron)
Microsoft Visual C++ 2005 Redistributable Package
Download SandMan Framework!
(1.1.1.20081008 version)Windows hibernation file for fun and profit - Black Hat USA 2008 Demos Enter SandMan - PacSec 2007, Japan - English
Enter SandMan - PacSec 2007, Japan - Japanese
Whitepaper
SandMan Project, Whitepaper
Online documentation SandMan framework manual
References FACE: Automated digital evidence discovery and correlation Andrew Case, Andrew Cristina, Lodovico Marziale, Golden G. Richard, Vassil Roussev
Open Memory Forensics Workshop, A. Walters, DFRWS 2008 Baltimore, Maryland.
Deperimetrisation : futur de la securite reseauou pis aller passager ? [FR] - C. Blancher
Voyage au coeur de la memoire [FR] D. Aumaitre - SSTIC'08. Rennes, France
Cryptographie : Attaques tous azimuts [FR] - JB. Bedrune, E. Filiol, F. Raynal. SSTIC'08, Rennes, France
Sample using SandMan library.
Wish list for the SandManlibrary [UP]
- Ability to parse any hibernation file, regardless of Windows version
- Including 32/64-bits
- Current state:
Operating System Service Pack/Build 32 bits 64 bits Windows Seven - CHECK CHECK Windows 2008 Server RTM SP0 YES CHECK Windows Vista SP1 RTM YES CHECK SP0 YES CHECK Windows 2003 Server SP2 YES CHECK SP1 YES CHECK SP0 YES CHECK Windows XP SP3 RC1 YES CHECK SP2 YES CHECK SP1 YES CHECK SP0 YES CHECK Windows 2000 SP4 NO HU? - Well-documented library
- Python binding
- Cool sample apps
- Convert to dd-style file
- Locate and patch pages (w/ fast lookup)
- Nice GUI
Project status [UP]
| Assigned | Development | Works | Mature | ||||||||||
| C Library | |||||||||||||
| Python portage | |||||||||||||
| Documentation | |||||||||||||
C Library HiberOpen() [ IMPLEMENTED ] HiberClose() [ IMPLEMENTED ] HiberBuildPhysicalMemoryDump() [ IMPLEMENTED ] HiberGetPhysicalMemorySize() [ IMPLEMENTED ] HiberReadFileHeader() [ IMPLEMENTED ] HiberWriteFileHeader() [ IMPLEMENTED ] HiberReadProcState() [ IMPLEMENTED ] HiberWriteProcState() [ IMPLEMENTED ] HiberGetVersion() [ IMPLEMENTED ] HiberCreateTree() [ IMPLEMENTED ] HiberDestroyTree() [ IMPLEMENTED ] HiberGetPageFirst() [ IMPLEMENTED ] HiberGetPageNext() [ IMPLEMENTED ] HiberIsPagePresent() [ IMPLEMENTED ] HiberGetPageAt() [ IMPLEMENTED ] HiberPatch() [ IMPLEMENTED ] HiberCountMemoryRanges() [ IMPLEMENTED ] HiberPageReplace() [ IMPLEMENTED ] HiberPageRemove() [ IMPLEMENTED ] MmGetPhysicalAddress() [ IMPLEMENTED ] MmFastGetPhysicalAddress() [ IMPLEMENTED ] IMPLEMENTED: 21 TOTAL: 21 % COMPLETED: 099 Python portage hiber_open() [ IMPLEMENTED ] hiber_close() [ IMPLEMENTED ] hiber_get_memsize() [ IMPLEMENTED ] hiber_patch() [ IMPLEMENTED ] hiber_dump() [ IMPLEMENTED ] hiber_read_file_header() [ IMPLEMENTED ] hiber_write_file_header() [ IMPLEMENTED ] hiber_read_proc_state() [ IMPLEMENTED ] hiber_write_proc_state() [ IMPLEMENTED ] hiber_get_version() [ IMPLEMENTED ] hiber_get_page_first() [ IMPLEMENTED ] hiber_get_page_next() [ IMPLEMENTED ] hiber_is_page_present() [ IMPLEMENTED ] hiber_get_page_at() [ IMPLEMENTED ] hiber_count_memory_ranges() [ IMPLEMENTED ] hiber_page_replace() [ IMPLEMENTED ] hiber_page_remove() [ IMPLEMENTED ] hiber_free_page() [ IMPLEMENTED ] hiber_get_page_at_va() [ IMPLEMENTED ] hiber_get_cr4() [ IMPLEMENTED ] hiber_get_cr3() [ IMPLEMENTED ] hiber_get_cr0() [ IMPLEMENTED ] % COMPLETED: 099