ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
5.06k stars 736 forks source link

I am encountering issues during a memory probe with the following details #265

Open Roma10boss opened 1 year ago

Roma10boss commented 1 year ago

Memory Map: START END #PAGES 0000000000000000 - 000000000009ffff 000000a0 00000000000c0000 - 00000000dfffffff 000dff40 00000000fb000000 - 00000000fba68fff 00000a69

Current Action: Probing Memory Access Mode: Normal Progress: 33267 / 33267 (100%) Speed: 67 MB/s Address: 0x000000081F380000 Pages read: 920137 / 8516480 (10%) Pages failed: 7596343 (89%) Memory Probe: Completed.

I'm unsure about the significance of the high failure rate, I would appreciate any guidance on resolving this issue. If there are specific steps I can take or additional information needed, please let me know. Thank you for your help.

ufrisk commented 1 year ago

Try to avoid the probe command if possible. Probe is unfortunately super aggressive and if you're on AMD things are guaranteed to stop working until you reboot.

You can check if DMA is working with pcileech.exe display -min 0x1000 -device fpga -v

If wanting to dump memory on AMD use a memory map, either you can try -memmap auto or you can create your own memory map for your targeted system (best way to do it).

More info at: https://github.com/ufrisk/LeechCore/wiki/Device_FPGA_AMD_Thunderbolt

serkonda7 commented 1 year ago

@ufrisk could you please add this disclaimer regarding aggressive probe to the readme.

ufrisk commented 1 year ago

Thanks for the suggestion. I'll add a warning about it since it's not the first time I get this question. I'll add it probably on Thursday since I'll update some cached offsets in info.db after this months patch Tuesday anyway then. It will look like the below image.

image

serkonda7 commented 1 year ago

Awesome! Thank you very much

FocuzJS commented 1 year ago

This doesn't effect 3xxx and newer AMD CPUs, it's mainly the 2xxx generation I've seen with the bridge disabling bus mastering in firmware on a bad map call 😃