search

ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.58k stars 695 forks source link

Freeze target PC during memory dump #282

Closed EmhyrVarEmreis closed 6 months ago

EmhyrVarEmreis commented 6 months ago

Hello

I think might be not a good place to ask as I might be not directly related to pcileech software, but anyway...

I have a program on target PC which is heavily modifying it's memory during runtime. When I use pcileech with fpga it works fine. But if I take memory dump the data is not coherent because program chenged data already dumped.

So, is there any way to freeze target PC (windows 11) for a while and then dump memory?

ufrisk commented 6 months ago

If you're using a PCILeech hardware device to capture the memory there is no way to snapshot the memory of the live system. You'd have to halt the system for that.

If you're using a VM there are usually some snapshot mechanism and PCILeech may read memory from some of those snapshot formats.