search

ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

Questions : Pcileech Over Thunderbolt 3/4? #193

Closed Dfaker-HK closed 2 years ago

Dfaker-HK commented 2 years ago

I plan to use a application which uses pcileech recently, and I have ordered a Enigma X1 for it, but there is a problem that my pc dont have spare pcie slot left where the only solution I could think is connect the X1 via thunderbolt to pcie converter, but I've heard that windows have recently add addtional protection against DMA over Thunderbolt, may I know if this still work via thunderbolt on the latest windows version? Source : https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt

ufrisk commented 2 years ago

I didn't know the Enigma X1 was back in stock yet?

Windows 11 by default block DMA on newer hardware. It also have newly attached devices disabled if your computer is locked.

But it's usually possible to disable these anti-DMA features in BIOS and such. Disable VT-d, Set thunderbiolt security level to Disabled/Legacy and so on. If this is done it usually works.

If your use case is breaking into systems Win11 will most probably block it. If your use case is analyzing memory of running processes you're likely to get it to work after some protections have been disabled.

Dfaker-HK commented 2 years ago

yes, I can get one from my china friend who work in the factory, and I am going to use it to analyze memory, thankyou so much!