ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

[AMD + Screamer M.2 R03] pcileech probe reads 10% then fails remaining #149

Closed dedbeef closed 4 years ago

dedbeef commented 4 years ago

I've tested the card extensively on an Intel Z170 board and have no issues, it runs very reliably. Testing on an AMD B450 (Aorus) using the command .\pcileech probe -device fpga -v -vv

I have disabled CSM, Secure Boot, IOMMU, SVM Mode and SMT while testing (is there anything else I'm missing?). The probe works fine for the first 10% of pages, then fails the remaining pages. Then when running the command again, it fails 100%.

Card is detecting fine it seems and LD1 and LD3 are lit indicating a solid connection. DEVICE: FPGA: ScreamerM2 PCIe gen2 x1 [300,0,500] [v4.3,0700]

I've also tried in the M.2 port, in a PCI-e port via the included adapter and via another PCI-e port to be on the safe side. Hoping you can point out something I can try, thanks in advance.

First probe

LcMemMap_AddRange: 0000000000000000-000000000009ffff -> 0000000000000000
LcMemMap_AddRange: 0000000000100000-000000081f37ffff -> 0000000000100000
LeechCore v2.0.2: Open Device: fpga
 Memory Map:
 START              END               #PAGES
 0000000000000000 - 000000000009ffff  000000a0
 00000000000c0000 - 00000000deffffff  000def40

 Current Action: Probing Memory
 Access Mode:    Normal
 Progress:       33267 / 33267 (100%)
 Speed:          386 MB/s
 Address:        0x000000081F380000
 Pages read:     913376 / 8516480 (10%)
 Pages failed:   7603104 (89%)
Memory Probe: Completed.

Subsequent Probes

FPGA: TINY PCIe TLP algrithm auto-selected!
LcMemMap_AddRange: 0000000000000000-000000000009ffff -> 0000000000000000
LcMemMap_AddRange: 0000000000100000-00000000ffffffff -> 0000000000100000
LeechCore v2.0.2: Open Device: fpga
 Memory Map:
 START              END               #PAGES

 Current Action: Probing Memory
 Access Mode:    Normal
 Progress:       4096 / 4096 (100%)
 Speed:          341 MB/s
 Address:        0x0000000100000000
 Pages read:     0 / 1048576 (0%)
 Pages failed:   1048576 (100%)
Memory Probe: Completed.
dedbeef commented 4 years ago

Oh, I checked your twitter after sponsoring and realised you released a version of PCI Leech/MemProcFS that supports Ryzen after the date around when I flashed these cards.

Does the Screamer M.2 binary that I flashed (1st July 2020, the date I flashed the card initially) support Ryzen? If not that may be the cause as I haven't flashed a new version since.

Really hoping you will tell me that the newer binary supports Ryzen and that this may be the issue. AMD Ryzen 5 3600X is the CPU.

Thanks in advance.

ufrisk commented 4 years ago

You would need the latest binaries (both for FPGA flashing and the .exe/.dll files) for it to work better. Also probe is rather aggressive so it may stop working after running a probe sometimes as you see in your first try. AMD does not like when reading / probing "memory holes" such as existing between approx 3-4GB. After a fail you will need to cold boot your system (i.e. shut it down and start it again; reboots usually isn't sufficient).

With the latest binaries you may do things like: pcileech.exe dump -v -vv -memmap auto if the target system is Windows. That will auto-detect potentially problematic memory regions to stay away from.

Also judging from your probe you may create a memory map file memmap.txt with following contents:

0000000000000000-000000000009ffff
00000000000c0000-00000000deffffff
0000000100000000-000000081f37ffff

and do things like pcileech.exe dump -v -vv -memmap memmap.txt

And huge thanks for supporting the project 💖 Not many people realize that I'm not affiliated with hardware sales and that I'm not getting any kickbacks whatsoever. Thank You!

dedbeef commented 4 years ago

I was gobsmacked when I found out you are self-funded (small mention in an issue) and will be talking to my colleagues to garner some more support for your extremely useful work.

And much appreciated, that makes perfect sense. I'm currently going through a the debugging process with 2 other new R04s and we may have stumbled on some other things that improved the stability dramatically. I'll post more info as soon as we've tested these ideas empirically.

ufrisk commented 4 years ago

huge thanks :) and I'm super interested in what the dramatically improved stability may be about, so much looking forward to the info :)

ufrisk commented 4 years ago

I just pushed some bug fixes for the fpga code for the tiny algorithm. This should hopefully resolve your remaining issues. Please let me know otherwise (and re-open the issue).