DeviceIOControl Failing about winpmem HOT 3 OPEN

I believe the format of the ioctl was changed with the most recent drivers. I don't know that the python code was updated - we don't use it really.

Can you successfully image using the c userspace program?

from winpmem.

Yes, we can currently use the winpmem exe to image.

Do you have any idea what the ioctrl setting would need to be updated to? Or documentation I could look into?

from winpmem.

This is the struct that gets passed in the ioctl

https://github.com/Velocidex/WinPmem/blob/master/kernel/userspace_interface/winpmem_shared.h

You need to update the layout here
https://github.com/google/rekall/blob/55d1925f2df9759a989b35271b4fa48fc54a1c86/tools/windows/winpmem/winpmem.py#L85

The ioctl numbers used now are here
https://github.com/Velocidex/WinPmem/blob/master/kernel/userspace_interface/ctl_codes.h

so you have to change them in the python code
https://github.com/google/rekall/blob/55d1925f2df9759a989b35271b4fa48fc54a1c86/tools/windows/winpmem/winpmem.py#L56

from winpmem.