search

ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

DokanUnmount? #157

Closed LuckyPi closed 3 years ago

LuckyPi commented 3 years ago

Ulf, Happy Holidays!

Curious if you've considered adding a feature to unmount filesystems?

Using the mount command "pcileech.exe mount -kmd 0x7ffee000 -device fpga", if I have a disconnect or if I'm finished with my work, I will have a disconnected lingering drive or worse a drive that appears connected but isn't that I can't get rid of until reboot. The "dokanctl.exe /u DriveLetter" command will unmount the drive, but I have to elevate privileges. Which is okay, but wondering if you have a workaround?

Thanks!

ufrisk commented 3 years ago

oh, I never thought about this; both an unmount option and a more clean way to unmount it when pressing ctrl+c is a very good suggestion. I'll put this up as an enhancement and add it in next release; hopefully some time in January since I'm away now for a couple of days over christmas :)

ufrisk commented 3 years ago

I've now looked into this. Apologies for the slight delay; I had to look into some MemProcFS issues/updates first.

Unfortunately it doesn't seem like I'll be able to do an unmount after the pcileech process that created the mount has been terminated. Dokan just won't allow that.

What I could do is to add a more clean shutdown; i.e. when ctrl+c is pressed pcileech will be able to unmount cleanly before terminating. Would this be helpful in your use case?

ufrisk commented 3 years ago

Update, I added the clean unmount when ctrl+c is pressed (or sent as a keystroke to the window I guess). Unfortunately it will be hard for me to do much more around this since dokan won't allow me to. I hope this will help in the majority of the cases though. I'm closing the issues; but please let me know if you should run into something not working as intended with the recent updates.