MoonSols Windows Memory Toolkit

Contact This e-mail address is being protected from spambots. You need JavaScript enabled to view it to get your Professional Edition copy !
More information

Here we are !

It's time to make a notable change to the way people are using memory dumps !

MoonSols is releasing his first product called "MoonSols Windows Memory Toolkit". MoonSols Windows Memory Toolkit is the most advanced toolkit for Windows physical memory snapshot management.

MoonSols Windows Memory Toolkit had been designed to deal with Microsoft Windows hibernation file (from Microsoft Windows XP to Microsoft Windows 7 in both 32-bits and 64-bits (x64) Editions), Microsoft full memory crashdump (in both 32-bits and 64-bits (x64) Editions), and raw memory dump files (from memory acquisition tools like win32dd or win64dd, or Virtualization application like VMWare). Moreover, MoonSols Windows Memory Toolkit also contains new version of win32dd and win64dd.

MoonSols Windows Memory Toolkit main point is that Microsoft full memory crashdump had been designed by Microsoft as the "physical memory format" which aims at being analyzed by Microsoft Windows Debugger (the most powerful utility to troubleshoot problems, analyze physical memory etc.). The goal of MoonSols Windows Memory Toolkit is to make possible to convert all Windows physical memory dumps into Microsoft Crash dump compliant with Microsoft Windows Debugger (WinDbg).

MoonSols Windows Memory Toolkit is available in two Edition.
- Community Version which is free.
- Professional Version which cost 500EUR per user. Contact This e-mail address is being protected from spambots. You need JavaScript enabled to view it for more information or you can directly order your copy here.

Community Edition and Professional Edition contains :
- win32dd  (one executable + one driver) 1.3.1.20100405
- win64dd  (one executable + one driver) 1.3.1.20100405
- hibr2dmp (one executable)              1.0.20100405
- hibr2bin (one executable)              1.0.20100405
- dmp2bin  (one executable)              1.0.20100405
- bin2dmp  (one executable)              1.0.20100405

Professional Edition contains:

- scripts\x64_dmp_ask.cmd Execute win64dd, create a Microsoft crash dump in dumps directory  and a trace log in log directory - Before the creation of the memory it ask for a confirmation.
- scripts\x64_dmp_do_NOT_ask.cmd Execute win64dd, create a Microsoft crash dump in dumps directory  and a trace log in log directory without asking for a confirmation.

- scripts\x64_raw_ask.cmd Execute win64dd, create a raw memory dump in dumps directory and a trace log in log directory - Before the creation of the memory it ask for a confirmation.
- scripts\x64_raw_do_NOT_ask.cmd Execute win64dd, create a raw memory dump in dumps directory and a  trace log in log directory without asking for a confirmation.


- scripts\x86_dmp_ask.cmd Execute win32dd, create a Microsoft crash dump in dumps directory and a trace log in log directory - Before the creation of the memory it ask for a confirmation.

- scripts\x86_dmp_do_NOT_ask.cmd Execute win32dd, create a Microsoft crash dump in dumps directory and a trace log in log directory without asking for a confirmation.

- scripts\x86_raw_ask.cmd Execute win32dd, create a raw memory dump in dumps directory and a  trace log in log directory - Before the creation of the memory it ask for a confirmation.
- scripts\x86_raw_do_NOT_ask.cmd Execute win32dd, create a raw memory dump in dumps directory and a trace log in log directory without asking for a confirmation.

- win32dd works for Microsoft Windows XP, 2003, 2008, Vista, 2008 R2, 7 32-bits Edition.
- win64dd works for Microsoft Windows XP, 2003, 2008, Vista, 2008 R2, 7 64-bits (x64) Edition.
You can both uses win32dd and/or win64dd with scripts or/and batch file. And you can also benefit of the interactive mode for the acquisition.
* Not possible with Community Edition.

- hibr2dmp and hibr2bin works with Microsoft Windows XP, 2003, 2008, Vista, 2008 R2, 7 32-bits and 64-bits (x64) Microsoft Windows hibernation files, including corrupted hibernation files. And the produced file is hashed with md5 algorithm (Professional Edition only).

* Community version only supports 32-bits Microsoft Windows hibernation files from XP to Vista.

- dmp2bin works with Microsoft Windows XP, 2003, 2008, Vista, 2008 R2, 7 32-bits and 64-bits (x64) Microsoft full memory crash dump files. And the produced file is hashed with md5 algorithm (Professional Edition only).

* Community version only supports 32-bits Microsoft crash dump.

- bin2dmp works with Microsoft Windows XP, 2003, 2008, Vista, 2008 R2, 7 32-bits and 64-bits (x64) raw memory snapshots (windd, VMWare -- Can also work with Live VMWare Virtual Machine but only in the Professional Edition). And the produced file is hashed with md5 algorithm (Professional Edition only).
* Community version only supports 32-bits images from XP to Vista.

The Community version is available at the following link :

http://moonsols.com/component/jdownloads/view.download/3/2

You are experiencing any problems contact us at : This e-mail address is being protected from spambots. You need JavaScript enabled to view it