Today we are releasing a new white paper that delivers a technical analysis of security weaknesses discovered in WinpMem, an open-source Windows memory acquisition driver widely used in digital forensics.
After a concise primer on relevant Windows internals (virtual vs. physical memory, page tables and PTEs, CR3 context switching, and kernel and user memory separation), the report examines how both the fundamental design of WinpMem and specific implementation choices create severe risk.
By design, the driver exposes an interface that enables access to arbitrary portions of system memory, a “read-anything-where” capability. While this functionality was intended for forensic convenience, it inherently breaks conventional isolation guarantees and magnifies the impact of any bug.
On the implementation side, the paper highlights critical defects, including a time-of-check to time-of-use issue. It shows how a seemingly limited “write-zero-where” primitive in reverse address queries can be transformed into a novel “write-anything-where” exploitation method.
The whitepaper demonstrates multiple exploitation techniques, including disabling driver-signature enforcement, manipulating kernel debugger flags, and tampering with security descriptors and tokens. It also discusses interactions with mitigations such as PatchGuard and HVCI/VBS, and assesses exploit stability across Windows versions.
First presented at REcon 2025 in Montreal, these findings highlight why memory acquisition drivers are dangerous by design, and why WinpMem, despite its adoption, should be considered unsafe in practice.
Please find the white paper at ERNW’s website: https://ernw.de/en/whitepapers/issue-73.html
Cheers!
Baptiste
If you want to learn more about ERNW’s work in the space of memory forensics you may find these posts interesting:
- Identification of (malicious) modifications in memory-mapped image files
- Release of PTE Analysis plugins for Volatility
- Looking for support in a digital forensics case? – ERNW Research can help.
- The author of the white paper, Baptiste David, also shares his knowledge in this training: Malware Techniques 101