search

ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

"Failed to retrieve physical memory map" Ubuntu 18.04.5 #168

Closed frenchcatapult closed 3 years ago

frenchcatapult commented 3 years ago

I'm running a PCIScreamer against Ubuntu 18.04.5, and running the command:

pcileech lx64_filepull -kmd LINUX_X64_48 -s /etc/shadow -out /tmp/shadow

I get the following output (after finding/verifying the kernel base address):

KMD: Code inserted into the kernel - Waiting to receive execution
KMD: Execution received - continuing ...
KMD: Failed. Failed to retrieve physical memory map
PCILEECH: Failed to load kernel module

Is this a target OS or BIOS configuration issue?

ufrisk commented 3 years ago

which kernel are you running on target? uname -r

frenchcatapult commented 3 years ago

Both the host and the target are running 4.15.0-112-generic, on 18.04.5

ufrisk commented 3 years ago

Thanks. I'm pretty sure something recently changed in the kernel changed that breaks something in my code. I'll have to look into it and fix it.

My Ubuntu 18.04.5 test VM fails every upgrade though; the update disk corrupts the disk irreparable every time I tried no matter how I tried to update it. I probably have to install this on physical hardware which will take time.

I'll look into it later when I have time. Thank you for reporting. I'll put this up as a bug.

Keeping track of all these Linux versions and updates is almost a full time job; I try to do my best; but please understand that this is a hobby project and I have many other things around this to look into so it may take some time.

I see lots of people buying expensive hardware for this. None of the current hardware sellers are contributing back to the project though; and only very few others. So it's basically me putting in countless of hours free work so that others can pocket handy profits without giving back. Please understand this may take a while. I'll let you know once I've fixed it though and thank you for reporting :)

ufrisk commented 3 years ago

I'm closing the issue since it's now resolved. Please let me know if you should be running into more issues in the future and I'll do my best to fix it. And best wishes with your research.