ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.72k stars 706 forks source link

Question on vmm reads vs pcileech dump performance #211

Closed shardadmin closed 1 year ago

shardadmin commented 1 year ago

Hello,

First, congrats on a very successful open source project. The documentation and features are great!

So when I run pcileech dump I get transfer speed of about 170MB/s. Now I wrote a simple test program that reads 0x1000 (4kbs) from a single virtual address in a loop (using VMMDLL_MemReadEx) with all the caching flags off. That program is able to perform ~5000 reads a second. If my math is right, that's around 20MB/s.

I initially thought it was latency but I also tried to have multiple concurrent threads reading at the same time and they all add up to the same amount as a single thread reads. Trying to read more data at once didn't help as well.

I'm trying to understand where the discrepancy is and whether there's anything I can do about it. Any pointers would be greatly appreciated.

ufrisk commented 1 year ago

Thank You.

The access to the hardware is serialized behind a lock. That's why you don't really see any substantial multithreaded gains.

Please note that there will probably be some small gains since the library itself is multi-threaded - just not the device accesses.

You may batch together several reads (if you know what address to read in advance) with the VMMDLLScatter* API.

ufrisk commented 1 year ago

I'm closing the issue due to old age. Also, I believe I have successfully answered your question and I hope the Scatter API is giving you the performance increases you were asking for.