winpmem module

professorbike · May 14, 2019 · 8bb0801 · 8bb0801
1 parent 4af8b30
commit 8bb0801
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/Modules/WinPmem.mkape b/Modules/WinPmem.mkape
@@ -0,0 +1,12 @@
+Description: WinPmem Memory Dump
+Category: Memory
+Author: Eric Capuano 
+Version: 1
+Id: 1d284835-417b-459e-a396-d228edea3808
+BinaryUrl: https://storage.googleapis.com/releases.rekall-forensic.com/v1.3.1/winpmem_1.6.2.exe
+ExportFormat: dmp
+Processors:
+    -
+        Executable: winpmem_1.6.2.exe
+        CommandLine: " %destinationDirectory%/memory.dmp"
+        ExportFormat: dmp
diff --git a/kape.exe b/kape.exe