ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.72k stars 706 forks source link

Modifying first blocks of config space? #216

Closed Tony322 closed 1 year ago

Tony322 commented 1 year ago

Hello! I've managed to flash and enable custom config space successfully on a squirrel that is built from source with the latest version 4.11 I'm in need to modify the early parts of the config space, that doesnt seem to be modifyable with the cfgspace.coe files. Not sure how it's possible. I think those blocks contain stuff like "capabilities" and stuff like that. But I'm not sure. Reason for this is that certain thing detect the FPGA by looking at these blocks by sig scan ;)

00: 86 80 39 15 02 00 10 00 03 00 00 02 10 00 00 00 10: 00 00 90 f6 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 43 10 f0 85 30: 00 00 00 00 40 00 00 00 00 00 00 00 0e 01 00 00 40: 01 48 03 78 08 00 00 00 05 60 80 00 00 00 00 00 <- Id like to modify this 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 10 00 02 00 e2 8f 00 00 50 29 00 00 12 f4 03 00 <- and this 70: 40 00 12 10 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 90: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: 00 00 00 00 00 00 00 00 ff ff f0 a8 ff ff f0 ac <- Custom config space applies from here b0: ff ff f0 b0 ff ff f0 b4 ff ff f0 b8 ff ff f0 bc c0: ff ff f0 c0 ff ff f0 c4 ff ff f0 c8 ff ff f0 cc d0: ff ff f0 d0 ff ff f0 d4 ff ff f0 d8 ff ff f0 dc e0: ff ff f0 e0 ff ff f0 e4 ff ff f0 e8 ff ff f0 ec f0: ff ff f0 f0 ff ff f0 f4 ff ff f0 f8 ff ff f0 fc

As you can see, the custom config space applies starting on block a0. If I wanted to modify the contents of block 40 and 60, how would I go on about doing that? Is it possible?

ufrisk commented 1 year ago

You're correct in that some parts are not modifiable by the pcileech_cfgspace.coe file.

The Xilinx PCIe core itself takes priority over the pcileech_cfgspace.coe part of the config space. You'd have to modify the file pcie_7x_0.xci or if you click around the PCIe wizard in Xilinx Vivado. This is a rather messy thing to do. You'd have to look up what the different values mean and try to change them and so on.

Tony322 commented 1 year ago

Damn, that was a quick response. Thank you. I also noticed I put this issue under the wrong section. Should probably have been under the fpga part. I will take a look and try to change some stuff. Would you believe there is a risk of bricking the squirrel if you would flash some firmware that is scuffed? If not, then I could just do some trial and error.

ufrisk commented 1 year ago

yeah, sometimes I'm answering quickly :)

Zero risk of bricking the device itself, but some configs will render the computer unbootable.

Also, for some combinations you'd have to edit the .xci file since the PCIe config wizard in Xilinx Vivado won't allow all combinations.

Yeah, just a lot of trial and error, and googling what the different values mean in the config space so you know what to try to change...

Best wishes with this.

I'm closing the issue since I believe I provided you with a good answer, but if you have any more questions feel free to ask more questions in this thread :)