ImDisk Virtual Disk Driver

Related tags

Miscellaneous ImDisk
Overview
  ImDisk Virtual Disk Driver for Windows NT/2000/XP/2003/Vista/7/8/8.1/10.

  This driver emulates harddisk partitions, floppy drives and CD/DVD-ROM
  drives from disk image files, in virtual memory or by redirecting I/O
  requests somewhere else, possibly to another machine, through a
  co-operating user-mode service, ImDskSvc.

  To install this driver, service and command line tool, right-click on the
  imdisk.inf file and select 'Install'. To uninstall, use the Add/Remove
  Programs applet in the Control Panel.

  You can get syntax help to the command line tool by typing just imdisk
  without parameters.

  I have tested this product under 32-bit versions of Windows NT 3.51, NT 4.0,
  2000, XP, Server 2003, Vista, 7, 8, 8.1 and 10 and x86-64 versions of XP,
  Server 2003, Vista, 7, 8, 8.1 and 10. Primary target are older versions and
  there are several known compatibility issues on modern version of Windows.
  Please see website for more details: https://ltr-data.se/opencode.html#ImDisk

  The install/uninstall routines do not work under NT 3.51. If you want to use
  this product under NT 3.51 you have to manually add registry entries needed
  by driver and service or use resource kit tools to add necessary settings.

    Copyright (c) 2005-2018 Olof Lagerkvist
    https://www.ltr-data.se      [email protected]

    Permission is hereby granted, free of charge, to any person
    obtaining a copy of this software and associated documentation
    files (the "Software"), to deal in the Software without
    restriction, including without limitation the rights to use,
    copy, modify, merge, publish, distribute, sublicense, and/or
    sell copies of the Software, and to permit persons to whom the
    Software is furnished to do so, subject to the following
    conditions:

    The above copyright notice and this permission notice shall be
    included in all copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
    OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
    NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
    HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
    WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
    OTHER DEALINGS IN THE SOFTWARE.

    This software contains some GNU GPL licensed code:
    - Parts related to floppy emulation based on VFD by Ken Kato.
      http://chitchat.at.infoseek.co.jp/vmware/vfd.html
    Copyright (C) Free Software Foundation, Inc.
    Read gpl.txt for the full GNU GPL license.

    This software may contain BSD licensed code:
    - Some code ported to NT from the FreeBSD md driver by Olof Lagerkvist.
      https://www.ltr-data.se
    Copyright (c) The FreeBSD Project.
    Copyright (c) The Regents of the University of California.

Comments
  • Is this the right setup for RAM disk?

    Is this the right setup for RAM disk?

    I have decided to create RAM disk to relieve some pressure from SDD drive when compiling software to prevent wear out, but still something is writing a lot to the SSD during the compilation process with MSVC, despite the whole project being put in a RAM drive and compiled from there. The fact that it is done inside virtual machine is irrelevant, right?

    I would like to make sure that I have correctly set up imDisk for this task. Could you take a look at the following screenshot and commands and tell that it indeed creates a partition in RAM and not anywhere else (like in the virtual memory of pagefile)?

    Manually starting these drivers due to #8:

    sc create imdisk type= kernel binpath= "C:\imdisk_test\imdisk.sys"
    sc start imdisk
    sc create awealloc type= kernel binpath= "C:\imdisk_test\awealloc.sys"
    sc start awealloc
    

    Then executing the cpl file:

    Ramdisk

    opened by T-640 23
  • Mount and unmount issue

    Mount and unmount issue

    • Windows 7 Pro x64

    I wrote 2 scripts to mount/unmount:

    mount.bat:

    imdisk -a -f "d:\a\shared-store.vdi" -m "d:\a\shared-store"
    

    unmount.bat:

    imdisk -d -m "d:\a\shared-store"
    

    The problem is that it can not mount nor unmount.

    Some time ago it has mount/dismount correctly. But after that is something did happen and mounting now is broken.

    The ProcessHacker shows that the System holds the vdi file: shared-store.vdi

    The mount.bat reports access denied on mount. The unmount.bat reports that the file is not found. All scripts does execute under Administrator privileges.

    If try to change the parameter from path d:\a\shared-store to drive e:, then the scripts reports almost the same.

    If try to run MountImg.exe it shows nothing mounted.

    The same vdi file mounts correctly by the VirtualBox Guest instance. If try to stop the VM instance with the vdi file attached and run scripts again, then the issue happens again.

    I read this issue but did't found a solution: https://github.com/LTRData/ImDisk/issues/10

    There is questions:

    • How to correctly dismount buggy mounted vdi file?
    • How mount vdi drive to a directory?
    opened by andry81 19
  • ImDisk doesn't seem to be compatible with Firefox

    ImDisk doesn't seem to be compatible with Firefox

    This is odd, but I triple-checked what I experienced, and here is the STR.

    1. Install Firefox v95.0.2 on a Win7 box.
    2. Install ImDisk v2.1.1.
    3. Create an ImDisk volume using the command: imdisk.exe -a -m G: -s 1g -p "/fs:exFAT /v:ImDisk /q /y"
    4. Create a Firefox profile on the ImDisk volume.
    5. Install Bonjourr in the Firefox profile and configure it as the new tab page.
    6. Open a new tab & notice that the Bonjourr page will never appear due to a storage error. (It works correctly on a non-ImDisk volume.)
    7. Install Tabliss in the Firefox profile and configure it as the new tab page.
    8. Open a new tab.
    9. Notice that the Tabliss page does appear.
    10. Now change settings in Tabliss.
    11. Notice that none of the Tabliss settings will be saved due to a storage I/O error (IO error: Incorrect function. (os error 1) ExtensionStorageSync.jsm:66). This only happens on an ImDisk volume.

    I also ran the same tests with the ImDisk volume formatted as NTFS. The same errors occurred.

    opened by Gitoffthelawn 14
  • Hangs on write into .vdi or .vmdk mounted image

    Hangs on write into .vdi or .vmdk mounted image

    • Windows x64 Pro SP1

    Got the stack trace from the Process Hacker one of threads has having the cycles. It does change over the time, but the WriteFile been blocked on something. The whole system suffers from WriteFile blocking and none of application can be closed or terminated which had call to WriteFile recently. Even can not be terminated through the Process Hacker itself. The Process Hacker somehow survived that and I could take a single stack dump. Only the hard reset can reset the system, which means it is a critical bug.

    Can't say how the notepad could save the stack trace into a file, may be the blocking is not stable.

    0, ntoskrnl.exe!KeInsertQueueApc+0x5cb
    1, ntoskrnl.exe!ObfReferenceObject+0x99d
    2, ntoskrnl.exe!KeWaitForSingleObject+0x1a3
    3, ntoskrnl.exe!longjmp+0x1c470
    4, Ntfs.sys+0x9bd48
    5, fltmgr.sys+0x1102
    6, fltmgr.sys!FltIsCallbackDataDirty+0x23ba
    7, fltmgr.sys!FltDeletePushLock+0x3ee
    8, ntoskrnl.exe!NtWriteFile+0x45f
    9, ntoskrnl.exe!longjmp+0x5bf3
    10, ntdll.dll!ZwWriteFile+0xa
    11, KernelBase.dll!WriteFile+0x7b
    12, kernel32.dll!WriteFile+0x36
    13, DomainNeutralILStubClass.IL_STUB_PInvoke(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte*, Int32, Int32 ByRef, IntPtr) + 0xc8 <-- mscorlib.ni.dll+0x63c9e8
    14, System.IO.FileStream.WriteFileNative(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte[], Int32, Int32, System.Threading.NativeOverlapped*, Int32 ByRef) + 0x83 <-- mscorlib.ni.dll+0x5ad683
    15, System.IO.FileStream.WriteCore(Byte[], Int32, Int32) + 0x5d <-- mscorlib.ni.dll+0x5ad5dd
    16, DiscUtils.Vmdk.HostedSparseExtentStream.Write(Byte[], Int32, Int32) + 0x12c <-- 0x7fe852b360c
    17, LTR.IO.ImDisk.Devio.Server.Providers.DevioProviderFromStream.Write(Byte[], Int32, Int32, Int64) + 0x3e <-- 0x7fe852b34ae
    18, LTR.IO.ImDisk.Devio.Server.Providers.DevioProviderManagedBase.Write(IntPtr, Int32, Int32, Int64) + 0x6b <-- 0x7fe852b343b
    19, LTR.IO.ImDisk.Devio.Server.Services.DevioShmService.WriteData(System.Runtime.InteropServices.SafeBuffer) + 0x175 <-- 0x7fe852b2fa5
    20, LTR.IO.ImDisk.Devio.Server.Services.DevioShmService.RunService() + 0x509 <-- 0x7fe852b17a9
    21, LTR.IO.ImDisk.Devio.Server.Services.DevioServiceBase.ServiceThreadProcedure() + 0x24 <-- 0x7fe852b0e24
    22, System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) + 0x172 <-- mscorlib.ni.dll+0x58df12
    23, System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) + 0x15 <-- mscorlib.ni.dll+0x58dd95
    24, System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) + 0x55 <-- mscorlib.ni.dll+0x58dd65
    25, System.Threading.ThreadHelper.ThreadStart() + 0x55 <-- mscorlib.ni.dll+0x633ea5
    26, clr.dll!LogHelp_LogAssert+0x1f13
    27, clr.dll!LogHelp_LogAssert+0x1e28
    28, clr.dll!LogHelp_LogAssert+0x2690
    29, clr.dll!ClrCreateManagedInstance+0x20bf
    30, clr.dll!LogHelp_LogAssert+0x3540
    31, clr.dll!LogHelp_LogAssert+0x34b3
    32, clr.dll!LogHelp_LogAssert+0x33f2
    33, clr.dll!LogHelp_LogAssert+0x35cf
    34, clr.dll!ClrCreateManagedInstance+0x1fa9
    35, clr.dll!LogHelp_LogAssert+0x68c5
    36, kernel32.dll!BaseThreadInitThunk+0xd
    37, ntdll.dll!RtlUserThreadStart+0x1d
    

    How to reproduce:

    1. Create dynamic .vdi or .vmdk file of 1TB size.
    2. Mount to drive B: and format for NTFS 4KB fast.
    3. Start copying 300GB of files from an SSD into it.
    4. After ~50GB it does hang and system from now can not be rebooted nor a process terminated.

    I have reproduced it on both .vdi (fastes coping) and .vmdk (slower, the stack trace is taken from). The .vhd is too slow to reach the 50GB point (< 10MB/s on any files) and might be not affected because of slowness (I feel there is might be some kind of a race condition with high speed writes).

    opened by andry81 11
  • Unable to run 2.1.1 installer

    Unable to run 2.1.1 installer

    With the latest release version (v2.1.1), I can't run the installer on Windows 10 or 2019. I get the following error: image

    But if I unzip the sfx and run install.cmd, it works all fine. runwaitw.exe is where it is expected.

    Any idea?

    opened by Thilas 10
  • There is some sort of problem when accessing elements inside an ImDisk based disk.

    There is some sort of problem when accessing elements inside an ImDisk based disk.

    Hi, I'm sorry about the undescriptive bug report title, but I couldn't think of anything better.

    A while ago I filed a report at ImDisk Toolkit's tracker, through which I'm using the ImDisk driver.

    Basically, I have setup a RAM disk that's always recreated at startup with user temporary directories pointing to it (i.e., R:\Temp), 8 GB, using AWE and being dynamic in terms of memory. It works great most of the times, but some applications seem to have a hard time working with it.

    These are some of the error messages that are shown:

    Intel graphics Installer

    oneAPI checking for space

    The first one belongs to the current graphic driver installer from Intel, it states that the application is in an unauthorized location, whatever that means. Also from Intel, their oneAPI compiler package installer complains X MB of space are needed, even when it was virtually empty. In both cases I had to move things out of the RAM disk for them to work.

    The behavior is similar in a way to what I encountered years ago when Process Hacker was updating and %TEMP% pointed to inside the RAM disk, I reported it over at their forums, and their developer kind of explained what the problem was, so I could report it properly, but I completely forgot about it. The reply is here, in case it's still relevant (it seems to have to do with IOCTLs): https://wj32.org/processhacker/forums/viewtopic.php?t=3419#p10644

    ON1

    I don't know if you guys are aware of the issue(s), but I just stumbled upon this project here and seeing there seems to be active development I thought of referencing it here too. The third picture belongs to another case that exhibits the same behavior, I had to temporarily switch the TEMP environmental variables to a real disk to be able to continue with that installation.

    Could you please look into it? Don't hesitate to let me know if you need more data samples, or you want logs of some sort, I would gladly do trial and error for you with debug builds of the driver. It needn't be signed, I could self sign them and make sure Windows trusts that signature to do the testing, or enable installation of unsigned drivers for the tests.

    Thank you for your time by the way.

    opened by jrmoore 9
  • Unable to unmount: access denied

    Unable to unmount: access denied

    When I access the mounted volume and then try to unmount it, sometimes it says access denied and I'm unable to do so, even though I'm not using the volume anymore. The only option in such a case is to restart my computer. What could be the problem?

    opened by nohopestage 8
  • Installation fails on Windows 11 for ARM64

    Installation fails on Windows 11 for ARM64

    Hello!

    When installation comes to the point of installing the inf file a message box with text "Installation failed." pops up. The installer, the script in zip file, and choosing the "Install" option when clicking on the inf file all fail with this error. All attempts were performed with administrator privileges. Files were downloaded from https://www.ltr-data.se/

    Manually loading the drivers via the sc create and sc start and executing the corresponding cpl file works though, I have managed to get them all to load that way and create partition in RAM.

    Not sure if that matters, but the system is a guest OS in a virtual machine which is disconnected from the Internet.

    opened by T-640 4
  • Compression and Encryption functionality?

    Compression and Encryption functionality?

    Hello,

    I am exploring ImDisk for use in a potential project and think that it is really an amazing piece of work from the testing that I have done so far.

    In addition to using it as a normal RAMDISK, I also have some ideas on how it might be used as part of a specialized IPC communication channel across independent applications written in different languages as well as for some other exciting work that I am trying to do as well.

    On thing that I was wondering is that I know ImDisk can save images since I was playing with the ImDisk TK (toolkit) but was wondering if there might be some type of compression settings so that upon saving the image then it would be compressed and upon loading then it would be decompressed.

    The other question is that I would like to investigate if there was any type of encryption functionality already built into ImDisk as that is a feature that I would like to use, but if it is not then maybe I could investigate adding it in some way but wanted to check first.

    Truly awesome work you have done along with the original developer and it still holds great potential for a lot of good use.

    Thanks and have a great day.

    opened by lonnietc 3
  • The build date and download size on https://ltr-data.se/opencode.html have changed, but the version number has not

    The build date and download size on https://ltr-data.se/opencode.html have changed, but the version number has not

    Hi Olof,

    I downloaded https://ltr-data.se/files/imdiskinst.exe from https://ltr-data.se/opencode.html/ (that's your site, correct?) the other day, and the site indicated it was v2.1.1, built on 2021-11-05 (IIRC). The download was 613KB.

    I then returned to https://ltr-data.se/opencode.html/ a few hours ago, and it indicated the version number was still v2.1.1, but it now indicated it was built on 2021-11-07 (as opposed to 2021-11-05). The download size increased substantially to 641KB.

    Also, 4 security vendors currently flag this file as malicious on virustotal.com, whereas the release from a couple days ago only currently has 1 malware flag.

    Do you know what's going on?

    Why is the download from https://ltr-data.se/opencode.html/ changing without the version number changing?

    Also, why do none of the file timestamps match the build date?

    Thank you for your help.

    opened by Gitoffthelawn 2
Owner
Olof Lagerkvist
Olof Lagerkvist
Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

CosMapper Loads a signed kernel driver (signed with leaked cert) which allows you to map any driver to kernel mode without any traces of the signed /

null 157 Jan 2, 2023
Professor Terence Parr has taught us how to create a virtual machine Now it is time to pwn virtual machine

My First real world CTF Simple Virtual Machine Challenge description Professor Terence Parr has taught us how to create a virtual machine Now it is ti

null 1 Feb 17, 2022
Graphs the disk IO in a linux terminal.

diskgraph Monitor for disk IO Introduction The diskgraph tool will graph disk IO under linux, in a terminal. Examples: $ ./diskgraph /dev/nvme0n1 $ ./

Bram Stolk 184 Nov 14, 2022
Microcontroller based switchless ROM switcher for the Commodore 1541-II disk drive

Retroninja 1541-II Switchless Multi-ROM A microcontroller based switchless ROM switcher for the Commodore 1541-II disk drive. Switch between stock CBM

retroninja 5 Sep 3, 2022
Hide SMBIOS/disk/NIC serials from EFI bootkit

Rainbow Rainbow is a bootkit like HWID spoofer for Windows. It abuses several hooks in EFI runtime services and uses clever DKOM to hide hardware seri

Samuel Tulach 184 Jan 6, 2023
A small proof-of-concept for using disk devices for DMA on Windows.

ddma A small proof-of-concept for using disk devices for DMA on Windows. Why Some native hypervisors (i.e. Hyper-V) allow the guest unvirtualized devi

null 55 Dec 30, 2022
A method from GH on how to stream a dll without touching disk, TAGS: fortnite cheat fortnite injector dll injector

dll-encryptor People who make pay hacks typically have down syndrome and are incapable of using their brains in any fashion, and yet these bath salt s

Micca 2 Nov 24, 2021
Tools to read Dragon32 VDK disk image files

Quick and dirty UNIX port of ddosutils This is originally an MSDOS tool to read Dragon 32 floppy disks. This version is crudely converted to operate o

Adrien Destugues 3 Sep 20, 2022
Comparing data of module exports from disk and memory, then caching any differences.

Inline-PatchFinder Need to see if the process you're reversing/analyzing is patching/hooking any loaded module's exports? Well, look no further. Inlin

null 14 Oct 15, 2022
Libguestfs is tools and a library for accessing and modifying guest disk images

Libguestfs is tools and a library for accessing and modifying guest disk images

null 527 Jan 1, 2023
This is a helper library to abstract away interfacing with floppy disk drives in a cross-platform and open source library.

Adafruit Floppy This is a helper library to abstract away interfacing with floppy disk drives in a cross-platform and open source library. Adafruit Fl

Adafruit Industries 142 Dec 19, 2022
x64 Windows kernel driver mapper, inject unsigned driver using anycall

anymapper x64 Windows kernel driver mapper, inject unsigned driver using anycall This project is WIP. Todo Fix: Can't make API calls from IAT nor func

Kento Oki 72 Dec 26, 2022
Driver leap - Self-sustainable fork of SteamVR driver for Leap Motion controller with updated vendor libraries

Driver Leap Self-sustainable fork of SteamVR driver for Leap Motion controller with updated vendor libraries Installation (for users) Install Ultralea

null 68 Jan 5, 2023
Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.

Hygieia The Greek goddess of health, her name is the source for the word "hygiene". Hygieia is a windows driver that works similarly to how pagewalkr

Deputation 103 Dec 4, 2022
SinMapper - usermode driver mapper that forcefully loads any signed kernel driver

usermode driver mapper that forcefully loads any signed kernel driver (legit cert) with a big enough section (example: .data, .rdata) to map your driver over. the main focus of this project is to prevent modern anti-cheats (BattlEye, EAC) from finding your driver and having the power to hook anything due to being inside of legit memory (signed legit driver).

null 170 Dec 29, 2022
Add virtual monitors to your windows 10 device! Works with Oculus software, obs, and any desktop sharing software

License MIT and CC0 or Public Domain, whichever is least restrictive -- Use it AS IS - NO IMPLICIT OR EXPLICIT warranty This may break your computer,

Rashi Abramson 230 Jan 6, 2023
NDS port of the uxn virtual machine

uxnds Quick and simple port of the uxn virtual machine to the NDS console. By default, uxnds will run /uxn/boot.rom. It also supports reading files fr

Adrian Siekierka 106 Dec 12, 2022
🎉 A framework for improving android 32bit app stability. (Alleviate crashes caused by insufficient virtual memory)

Patrons ?? A framework for improving android 32bit app stability. (Alleviate crashes caused by insufficient virtual memory) 一行代码解决 Android 32位应用因虚拟内存不

Alibaba 378 Dec 29, 2022
A port of the Uxn virtual machine to the ESP32

Uxn An assembler and emulator for the Uxn stack-machine, written in ANSI C. Build Linux To build the Uxn emulator, you must have SDL2. If you wish to

Maxime ANDRÉ 27 Mar 24, 2022