The LeechCore library supports reading live memory by using Sysinternals LiveKd.

Facts in short:

• Is supported on 64-bit Windows.
• Acquires memory in read-only mode.
• May acquires memory from Hyper-V guest VM from Hyper-V host.
• Is slow (2MB/s) due to current inefficiencies in LiveKd driver.
• Acquired memory is assumed to be volatile.
• Have additional requirements.

The LeechCore process must be started from LiveKd in elevated administrator mode for LiveKd to be able to capture live memory.

LeechCore API:

Please specify the acquisition device type in LC_CONFIG.szDevice when calling LcCreate. The acquisition device type is livekd.

PCILeech / MemProcFS:

Please specify the device type in the -device option or start from LiveKd directly

Examples:

-device livekd -remote rpc://<spn>:<somehost>

LiveKd.exe -k MemProcFS.exe

Depends on LiveKd.exe. Please download the latest version of Sysinternals LiveKd from Microsoft.