ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

Speed issue #159

Closed Remashes closed 3 years ago

Remashes commented 3 years ago

Hello, is using vmm.dll the fastest way to use it creating my own code? I'm having delay issues using screamer M.2

ufrisk commented 3 years ago

yes, if you use it in a C/C++ setting and wish to do windows memory analysis vmm.dll is the way to go.

if just wanting to read raw physical memory leechcore.dll is the way to go.

Also there are Python/C# APIs.

Delay issues is a vague term; what does your delay issues consist about and how do they look like?

Remashes commented 3 years ago

I'm reading a process memory every 10ms, doing like 8 to 10 small reads and this is taking like 100ms so the main thread gets delayed.

ufrisk commented 3 years ago

is it this slow every time, or just now and then?

if you run pcileech.exe -device fpga -v dump -out none -memmap auto how many MB/s do you get?

Remashes commented 3 years ago

Always taking almost the same time. I'm getting between 110 to 120 MB/s, so seems fine, is there any way to improve speed of reads using VMMDLL_MemRead and VMMDLL_MemReadEx? Does cache use some of the bandwidth while this read are being performed?

ufrisk commented 3 years ago

it does indeed seems to be a bit slow; it may be due to some reasons; but default a few extra pages will be read if there is a small read; I don't think it should affect that much though; but I'm not sure.

You can try to reduce your latencies with these flags: VMMDLL_FLAG_NOPAGING_IO VMMDLL_FLAG_NOPAGING VMMDLL_FLAG_NOCACHE

I may have to add another flag to skip the extra reads.

Also, if you're doing X number of reads that aren't dependent on eachother; i.e. sequence of pointers; you may read all values at the same time with no additional latency with the MemReadScatter function; but it's a bit complicated to use. There is an example in the example project.

Please let me know if any of the above flags improves your situation first tho; if not I could try to look into the extra reads and add another flag to skip them for next version.

bbhxwl commented 3 years ago

yes, if you use it in a C/C++ setting and wish to do windows memory analysis vmm.dll is the way to go.

if just wanting to read raw physical memory leechcore.dll is the way to go.

Also there are Python/C# APIs.

Delay issues is a vague term; what does your delay issues consist about and how do they look like?

Can you tell me where CSharp API is?

ufrisk commented 3 years ago

@bbhxwl

Please understand that this is a hobby project of mine. I don't sell hardware - other people to. I get absolutely zero revenues from hardware sales. I have a normal day job. Please also understand that I'm not able to be stand-by 24/7 to answer a flood of different questions completely for free.

Anyway,

1+2) I have linked the different hardwares on https://github.com/ufrisk/pcileech-fpga - depending on what your need is I'd recommend going with the RaptorDMA if you're targeting an ordinary PCIe slot; all else the ScreamerM2 is excellent (and it works for normal PCIe as well).

3) The C# API and examples are documented here: https://github.com/ufrisk/MemProcFS/tree/master/vmmsharp check out vmm_example.cs for the examples about how to use the API.

Good Luck with everything and your DMA research.

bbhxwl commented 3 years ago

@bbhxwl

Please understand that this is a hobby project of mine. I don't sell hardware - other people to. I get absolutely zero revenues from hardware sales. I have a normal day job. Please also understand that I'm not able to be stand-by 24/7 to answer a flood of different questions completely for free.

Anyway,

1+2) I have linked the different hardwares on https://github.com/ufrisk/pcileech-fpga - depending on what your need is I'd recommend going with the RaptorDMA if you're targeting an ordinary PCIe slot; all else the ScreamerM2 is excellent (and it works for normal PCIe as well).

  1. The C# API and examples are documented here: https://github.com/ufrisk/MemProcFS/tree/master/vmmsharp check out vmm_example.cs for the examples about how to use the API.

Good Luck with everything and your DMA research.

Thank you, I just understand DMA, many do not understand, thank you for your help, I may have to buy hardware before learning.

bbhxwl commented 3 years ago

@bbhxwl

Please understand that this is a hobby project of mine. I don't sell hardware - other people to. I get absolutely zero revenues from hardware sales. I have a normal day job. Please also understand that I'm not able to be stand-by 24/7 to answer a flood of different questions completely for free.

Anyway,

1+2) I have linked the different hardwares on https://github.com/ufrisk/pcileech-fpga - depending on what your need is I'd recommend going with the RaptorDMA if you're targeting an ordinary PCIe slot; all else the ScreamerM2 is excellent (and it works for normal PCIe as well).

  1. The C# API and examples are documented here: https://github.com/ufrisk/MemProcFS/tree/master/vmmsharp check out vmm_example.cs for the examples about how to use the API.

Good Luck with everything and your DMA research.

Does this project have a related forum or group? I'm a beginner. China doesn't have this information. I'm not sure if my motherboard can use DMA hardware, as if this project can also use no hardware?