ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.72k stars 706 forks source link

Pcieleech is blocked when a process is running. VMDLL_Initialize Failed #234

Closed Youssix closed 1 year ago

Youssix commented 1 year ago

Hello everyone,

i'm asking here why does my dma doesnt work when a certain process is running.

Here is what i got when initializing my VMMDLL.

https://i.imgur.com/hVtvQOr.png

Here is the verbose mode :

https://pastebin.com/f3asc2b7

Thanks, i wish to know the problem here.

I also tried to overwrite DRAM address at the beginning to remove Intel vt/d but it didnt help.

ufrisk commented 1 year ago

Hi,

Yes, some games anti-cheats do this unless VT-d is not already and previously enabled by Windows in either full blocking mode or limited write-blocking mode or if you managed to disable it in other ways before your certain process started.

Please understand that PCILeech/MemProcFS primarily is a offensive security / forensics software and that I won't actively help you to circumvent the games anti-cheat.

I'm sure there are multiple ways to go around with it though if you ask around on other forums though.

Thanks for understanding and best wishes with this.