ImDisk Virtual Disk Driver for Windows NT/2000/XP/2003/Vista/7/8/8.1/10. This driver emulates harddisk partitions, floppy drives and CD/DVD-ROM drives from disk image files, in virtual memory or by redirecting I/O requests somewhere else, possibly to another machine, through a co-operating user-mode service, ImDskSvc. To install this driver, service and command line tool, right-click on the imdisk.inf file and select 'Install'. To uninstall, use the Add/Remove Programs applet in the Control Panel. You can get syntax help to the command line tool by typing just imdisk without parameters. I have tested this product under 32-bit versions of Windows NT 3.51, NT 4.0, 2000, XP, Server 2003, Vista, 7, 8, 8.1 and 10 and x86-64 versions of XP, Server 2003, Vista, 7, 8, 8.1 and 10. Primary target are older versions and there are several known compatibility issues on modern version of Windows. Please see website for more details: https://ltr-data.se/opencode.html#ImDisk The install/uninstall routines do not work under NT 3.51. If you want to use this product under NT 3.51 you have to manually add registry entries needed by driver and service or use resource kit tools to add necessary settings. Copyright (c) 2005-2018 Olof Lagerkvist https://www.ltr-data.se [email protected] Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. This software contains some GNU GPL licensed code: - Parts related to floppy emulation based on VFD by Ken Kato. http://chitchat.at.infoseek.co.jp/vmware/vfd.html Copyright (C) Free Software Foundation, Inc. Read gpl.txt for the full GNU GPL license. This software may contain BSD licensed code: - Some code ported to NT from the FreeBSD md driver by Olof Lagerkvist. https://www.ltr-data.se Copyright (c) The FreeBSD Project. Copyright (c) The Regents of the University of California.
ImDisk Virtual Disk Driver
Overview
Comments
-
Is this the right setup for RAM disk?
I have decided to create RAM disk to relieve some pressure from SDD drive when compiling software to prevent wear out, but still something is writing a lot to the SSD during the compilation process with MSVC, despite the whole project being put in a RAM drive and compiled from there. The fact that it is done inside virtual machine is irrelevant, right?
I would like to make sure that I have correctly set up imDisk for this task. Could you take a look at the following screenshot and commands and tell that it indeed creates a partition in RAM and not anywhere else (like in the virtual memory of pagefile)?
Manually starting these drivers due to #8:
sc create imdisk type= kernel binpath= "C:\imdisk_test\imdisk.sys" sc start imdisk sc create awealloc type= kernel binpath= "C:\imdisk_test\awealloc.sys" sc start awealloc
Then executing the cpl file:
-
Mount and unmount issue
- Windows 7 Pro x64
I wrote 2 scripts to mount/unmount:
mount.bat:
imdisk -a -f "d:\a\shared-store.vdi" -m "d:\a\shared-store"
unmount.bat:
imdisk -d -m "d:\a\shared-store"
The problem is that it can not mount nor unmount.
Some time ago it has mount/dismount correctly. But after that is something did happen and mounting now is broken.
The
ProcessHacker
shows that the System holds the vdi file:shared-store.vdi
The
mount.bat
reportsaccess denied
on mount. Theunmount.bat
reports that the file is not found. All scripts does execute under Administrator privileges.If try to change the parameter from path
d:\a\shared-store
to drivee:
, then the scripts reports almost the same.If try to run
MountImg.exe
it shows nothing mounted.The same vdi file mounts correctly by the VirtualBox Guest instance. If try to stop the VM instance with the vdi file attached and run scripts again, then the issue happens again.
I read this issue but did't found a solution: https://github.com/LTRData/ImDisk/issues/10
There is questions:
- How to correctly dismount buggy mounted vdi file?
- How mount vdi drive to a directory?
-
ImDisk doesn't seem to be compatible with Firefox
This is odd, but I triple-checked what I experienced, and here is the STR.
- Install Firefox v95.0.2 on a Win7 box.
- Install ImDisk v2.1.1.
- Create an ImDisk volume using the command:
imdisk.exe -a -m G: -s 1g -p "/fs:exFAT /v:ImDisk /q /y"
- Create a Firefox profile on the ImDisk volume.
- Install Bonjourr in the Firefox profile and configure it as the new tab page.
- Open a new tab & notice that the Bonjourr page will never appear due to a storage error. (It works correctly on a non-ImDisk volume.)
- Install Tabliss in the Firefox profile and configure it as the new tab page.
- Open a new tab.
- Notice that the Tabliss page does appear.
- Now change settings in Tabliss.
- Notice that none of the Tabliss settings will be saved due to a storage I/O error (
IO error: Incorrect function. (os error 1) ExtensionStorageSync.jsm:66
). This only happens on an ImDisk volume.
I also ran the same tests with the ImDisk volume formatted as NTFS. The same errors occurred.
-
Hangs on write into .vdi or .vmdk mounted image
- Windows x64 Pro SP1
Got the stack trace from the Process Hacker one of threads has having the cycles. It does change over the time, but the WriteFile been blocked on something. The whole system suffers from WriteFile blocking and none of application can be closed or terminated which had call to WriteFile recently. Even can not be terminated through the Process Hacker itself. The Process Hacker somehow survived that and I could take a single stack dump. Only the hard reset can reset the system, which means it is a critical bug.
Can't say how the notepad could save the stack trace into a file, may be the blocking is not stable.
0, ntoskrnl.exe!KeInsertQueueApc+0x5cb 1, ntoskrnl.exe!ObfReferenceObject+0x99d 2, ntoskrnl.exe!KeWaitForSingleObject+0x1a3 3, ntoskrnl.exe!longjmp+0x1c470 4, Ntfs.sys+0x9bd48 5, fltmgr.sys+0x1102 6, fltmgr.sys!FltIsCallbackDataDirty+0x23ba 7, fltmgr.sys!FltDeletePushLock+0x3ee 8, ntoskrnl.exe!NtWriteFile+0x45f 9, ntoskrnl.exe!longjmp+0x5bf3 10, ntdll.dll!ZwWriteFile+0xa 11, KernelBase.dll!WriteFile+0x7b 12, kernel32.dll!WriteFile+0x36 13, DomainNeutralILStubClass.IL_STUB_PInvoke(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte*, Int32, Int32 ByRef, IntPtr) + 0xc8 <-- mscorlib.ni.dll+0x63c9e8 14, System.IO.FileStream.WriteFileNative(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte[], Int32, Int32, System.Threading.NativeOverlapped*, Int32 ByRef) + 0x83 <-- mscorlib.ni.dll+0x5ad683 15, System.IO.FileStream.WriteCore(Byte[], Int32, Int32) + 0x5d <-- mscorlib.ni.dll+0x5ad5dd 16, DiscUtils.Vmdk.HostedSparseExtentStream.Write(Byte[], Int32, Int32) + 0x12c <-- 0x7fe852b360c 17, LTR.IO.ImDisk.Devio.Server.Providers.DevioProviderFromStream.Write(Byte[], Int32, Int32, Int64) + 0x3e <-- 0x7fe852b34ae 18, LTR.IO.ImDisk.Devio.Server.Providers.DevioProviderManagedBase.Write(IntPtr, Int32, Int32, Int64) + 0x6b <-- 0x7fe852b343b 19, LTR.IO.ImDisk.Devio.Server.Services.DevioShmService.WriteData(System.Runtime.InteropServices.SafeBuffer) + 0x175 <-- 0x7fe852b2fa5 20, LTR.IO.ImDisk.Devio.Server.Services.DevioShmService.RunService() + 0x509 <-- 0x7fe852b17a9 21, LTR.IO.ImDisk.Devio.Server.Services.DevioServiceBase.ServiceThreadProcedure() + 0x24 <-- 0x7fe852b0e24 22, System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) + 0x172 <-- mscorlib.ni.dll+0x58df12 23, System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) + 0x15 <-- mscorlib.ni.dll+0x58dd95 24, System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) + 0x55 <-- mscorlib.ni.dll+0x58dd65 25, System.Threading.ThreadHelper.ThreadStart() + 0x55 <-- mscorlib.ni.dll+0x633ea5 26, clr.dll!LogHelp_LogAssert+0x1f13 27, clr.dll!LogHelp_LogAssert+0x1e28 28, clr.dll!LogHelp_LogAssert+0x2690 29, clr.dll!ClrCreateManagedInstance+0x20bf 30, clr.dll!LogHelp_LogAssert+0x3540 31, clr.dll!LogHelp_LogAssert+0x34b3 32, clr.dll!LogHelp_LogAssert+0x33f2 33, clr.dll!LogHelp_LogAssert+0x35cf 34, clr.dll!ClrCreateManagedInstance+0x1fa9 35, clr.dll!LogHelp_LogAssert+0x68c5 36, kernel32.dll!BaseThreadInitThunk+0xd 37, ntdll.dll!RtlUserThreadStart+0x1d
How to reproduce:
- Create dynamic .vdi or .vmdk file of 1TB size.
- Mount to drive B: and format for NTFS 4KB fast.
- Start copying 300GB of files from an SSD into it.
- After ~50GB it does hang and system from now can not be rebooted nor a process terminated.
I have reproduced it on both .vdi (fastes coping) and .vmdk (slower, the stack trace is taken from). The .vhd is too slow to reach the 50GB point (< 10MB/s on any files) and might be not affected because of slowness (I feel there is might be some kind of a race condition with high speed writes).
-
Unable to run 2.1.1 installer
With the latest release version (v2.1.1), I can't run the installer on Windows 10 or 2019. I get the following error:
But if I unzip the sfx and run
install.cmd
, it works all fine.runwaitw.exe
is where it is expected.Any idea?
-
There is some sort of problem when accessing elements inside an ImDisk based disk.
Hi, I'm sorry about the undescriptive bug report title, but I couldn't think of anything better.
A while ago I filed a report at ImDisk Toolkit's tracker, through which I'm using the ImDisk driver.
Basically, I have setup a RAM disk that's always recreated at startup with user temporary directories pointing to it (i.e., R:\Temp), 8 GB, using AWE and being dynamic in terms of memory. It works great most of the times, but some applications seem to have a hard time working with it.
These are some of the error messages that are shown:
The first one belongs to the current graphic driver installer from Intel, it states that the application is in an unauthorized location, whatever that means. Also from Intel, their oneAPI compiler package installer complains X MB of space are needed, even when it was virtually empty. In both cases I had to move things out of the RAM disk for them to work.
The behavior is similar in a way to what I encountered years ago when Process Hacker was updating and %TEMP% pointed to inside the RAM disk, I reported it over at their forums, and their developer kind of explained what the problem was, so I could report it properly, but I completely forgot about it. The reply is here, in case it's still relevant (it seems to have to do with IOCTLs): https://wj32.org/processhacker/forums/viewtopic.php?t=3419#p10644
I don't know if you guys are aware of the issue(s), but I just stumbled upon this project here and seeing there seems to be active development I thought of referencing it here too. The third picture belongs to another case that exhibits the same behavior, I had to temporarily switch the TEMP environmental variables to a real disk to be able to continue with that installation.
Could you please look into it? Don't hesitate to let me know if you need more data samples, or you want logs of some sort, I would gladly do trial and error for you with debug builds of the driver. It needn't be signed, I could self sign them and make sure Windows trusts that signature to do the testing, or enable installation of unsigned drivers for the tests.
Thank you for your time by the way.
-
Unable to unmount: access denied
When I access the mounted volume and then try to unmount it, sometimes it says access denied and I'm unable to do so, even though I'm not using the volume anymore. The only option in such a case is to restart my computer. What could be the problem?
-
Installation fails on Windows 11 for ARM64
Hello!
When installation comes to the point of installing the inf file a message box with text "Installation failed." pops up. The installer, the script in zip file, and choosing the "Install" option when clicking on the inf file all fail with this error. All attempts were performed with administrator privileges. Files were downloaded from https://www.ltr-data.se/
Manually loading the drivers via the
sc create
andsc start
and executing the corresponding cpl file works though, I have managed to get them all to load that way and create partition in RAM.Not sure if that matters, but the system is a guest OS in a virtual machine which is disconnected from the Internet.
-
Compression and Encryption functionality?
Hello,
I am exploring ImDisk for use in a potential project and think that it is really an amazing piece of work from the testing that I have done so far.
In addition to using it as a normal RAMDISK, I also have some ideas on how it might be used as part of a specialized IPC communication channel across independent applications written in different languages as well as for some other exciting work that I am trying to do as well.
On thing that I was wondering is that I know ImDisk can save images since I was playing with the ImDisk TK (toolkit) but was wondering if there might be some type of compression settings so that upon saving the image then it would be compressed and upon loading then it would be decompressed.
The other question is that I would like to investigate if there was any type of encryption functionality already built into ImDisk as that is a feature that I would like to use, but if it is not then maybe I could investigate adding it in some way but wanted to check first.
Truly awesome work you have done along with the original developer and it still holds great potential for a lot of good use.
Thanks and have a great day.
-
The build date and download size on https://ltr-data.se/opencode.html have changed, but the version number has not
Hi Olof,
I downloaded https://ltr-data.se/files/imdiskinst.exe from https://ltr-data.se/opencode.html/ (that's your site, correct?) the other day, and the site indicated it was v2.1.1, built on 2021-11-05 (IIRC). The download was 613KB.
I then returned to https://ltr-data.se/opencode.html/ a few hours ago, and it indicated the version number was still v2.1.1, but it now indicated it was built on 2021-11-07 (as opposed to 2021-11-05). The download size increased substantially to 641KB.
Also, 4 security vendors currently flag this file as malicious on virustotal.com, whereas the release from a couple days ago only currently has 1 malware flag.
Do you know what's going on?
Why is the download from https://ltr-data.se/opencode.html/ changing without the version number changing?
Also, why do none of the file timestamps match the build date?
Thank you for your help.
Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.
CosMapper Loads a signed kernel driver (signed with leaked cert) which allows you to map any driver to kernel mode without any traces of the signed /
Professor Terence Parr has taught us how to create a virtual machine Now it is time to pwn virtual machine
My First real world CTF Simple Virtual Machine Challenge description Professor Terence Parr has taught us how to create a virtual machine Now it is ti
Graphs the disk IO in a linux terminal.
diskgraph Monitor for disk IO Introduction The diskgraph tool will graph disk IO under linux, in a terminal. Examples: $ ./diskgraph /dev/nvme0n1 $ ./
Microcontroller based switchless ROM switcher for the Commodore 1541-II disk drive
Retroninja 1541-II Switchless Multi-ROM A microcontroller based switchless ROM switcher for the Commodore 1541-II disk drive. Switch between stock CBM
Hide SMBIOS/disk/NIC serials from EFI bootkit
Rainbow Rainbow is a bootkit like HWID spoofer for Windows. It abuses several hooks in EFI runtime services and uses clever DKOM to hide hardware seri
A small proof-of-concept for using disk devices for DMA on Windows.
ddma A small proof-of-concept for using disk devices for DMA on Windows. Why Some native hypervisors (i.e. Hyper-V) allow the guest unvirtualized devi
A method from GH on how to stream a dll without touching disk, TAGS: fortnite cheat fortnite injector dll injector
dll-encryptor People who make pay hacks typically have down syndrome and are incapable of using their brains in any fashion, and yet these bath salt s
Tools to read Dragon32 VDK disk image files
Quick and dirty UNIX port of ddosutils This is originally an MSDOS tool to read Dragon 32 floppy disks. This version is crudely converted to operate o
Comparing data of module exports from disk and memory, then caching any differences.
Inline-PatchFinder Need to see if the process you're reversing/analyzing is patching/hooking any loaded module's exports? Well, look no further. Inlin
Libguestfs is tools and a library for accessing and modifying guest disk images
Libguestfs is tools and a library for accessing and modifying guest disk images
This is a helper library to abstract away interfacing with floppy disk drives in a cross-platform and open source library.
Adafruit Floppy This is a helper library to abstract away interfacing with floppy disk drives in a cross-platform and open source library. Adafruit Fl
x64 Windows kernel driver mapper, inject unsigned driver using anycall
anymapper x64 Windows kernel driver mapper, inject unsigned driver using anycall This project is WIP. Todo Fix: Can't make API calls from IAT nor func
Driver leap - Self-sustainable fork of SteamVR driver for Leap Motion controller with updated vendor libraries
Driver Leap Self-sustainable fork of SteamVR driver for Leap Motion controller with updated vendor libraries Installation (for users) Install Ultralea
Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.
Hygieia The Greek goddess of health, her name is the source for the word "hygiene". Hygieia is a windows driver that works similarly to how pagewalkr
SinMapper - usermode driver mapper that forcefully loads any signed kernel driver
usermode driver mapper that forcefully loads any signed kernel driver (legit cert) with a big enough section (example: .data, .rdata) to map your driver over. the main focus of this project is to prevent modern anti-cheats (BattlEye, EAC) from finding your driver and having the power to hook anything due to being inside of legit memory (signed legit driver).
Add virtual monitors to your windows 10 device! Works with Oculus software, obs, and any desktop sharing software
License MIT and CC0 or Public Domain, whichever is least restrictive -- Use it AS IS - NO IMPLICIT OR EXPLICIT warranty This may break your computer,
NDS port of the uxn virtual machine
uxnds Quick and simple port of the uxn virtual machine to the NDS console. By default, uxnds will run /uxn/boot.rom. It also supports reading files fr
🎉 A framework for improving android 32bit app stability. (Alleviate crashes caused by insufficient virtual memory)
Patrons ?? A framework for improving android 32bit app stability. (Alleviate crashes caused by insufficient virtual memory) 一行代码解决 Android 32位应用因虚拟内存不
A port of the Uxn virtual machine to the ESP32
Uxn An assembler and emulator for the Uxn stack-machine, written in ANSI C. Build Linux To build the Uxn emulator, you must have SDL2. If you wish to