ufrisk / pcileech-fpga

FPGA modules used together with the PCILeech Direct Memory Access (DMA) Attack Software
917 stars 205 forks source link

fix for git: ekknod/drvscan scan_pcileech #127

Closed ekknod closed 1 year ago

ekknod commented 1 year ago

https://github.com/ekknod/drvscan/blob/main/Client/main.cpp#L447 When writing at shadow config space (0xA8-0x3FF) system is going to freeze. This can be "fixed" by directing write addresses to 0x00, that way write protection stays enabled without freeze.

ufrisk commented 1 year ago

Nice catch,

I'm gussing this might even clear up some of the issues with stuck drivers if you try to mimic a real device. I always thought it had to do with me not having implemented full BAR support. But I guess it may very well be a combination of the two. Nevertheless I think it would be good to apply this fix.

The fix as such would break the writable config space option though. I know at least some people that are relying on this feature.

Proper fix would be to do in pcileech_pcie_cfgspace_shadow.sv change line:

wire bram_wr_1_tlp = dshadow2tlp.rx_wren & dshadow2fifo.cfgtlp_wren; to wire bram_wr_1_tlp = dshadow2tlp.rx_wren;

AND

wire [3:0] bram_wr_be = bram_wr_1_tlp ? dshadow2tlp.rx_be : (bram_wr_2_usb ? dshadow2fifo.rx_be : (bram_wr_3_int ? 4'b1111 : 4'b0000)); to wire [3:0] bram_wr_be = bram_wr_1_tlp ? (dshadow2fifo.cfgtlp_wren ? dshadow2tlp.rx_be : 4'b0000) : (bram_wr_2_usb ? dshadow2fifo.rx_be : (bram_wr_3_int ? 4'b1111 : 4'b0000));

Will you update the pull request (please also state that it's contributed under MIT license (or public domain)). Or do you prefer for me to do the update?

ekknod commented 1 year ago

Files should be now up to date. Suggest to double check just in case.

ufrisk commented 1 year ago

Many thanks for this. I'll update the default builds with the fix a bit later this weekend.