search

ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
5.06k stars 736 forks source link

read memory size and data problem #290

Closed nikolindima closed 9 months ago

nikolindima commented 9 months ago

Hello, i use Enigma X1. Target PC has 4gb memory. when try to dump it all went fine but it show 6gb size and dumping 6gb with 2gb errors pages in the end. and data in dump looks strange every time. If target PC has 8gb memory - dumping 10gb. i use pcileech.exe dump -out "d:\raw.bin" command

ufrisk commented 9 months ago

what do you see if you run: pcileech.exe -device fpga dump -v it would be interesting to know if things are normal or not. what you're describing is normal expected behavior.

A PC with 8GB RAM will have approx the address space I describe below: 0-2 GB = RAM 2-4 GB = MEMORY MAPPED PCIE DEVICES 4-10 GB = RAM

The address space in my short example is 10GB even though it only contains 8GB RAM. There is a hole in the middle used for PCI Express Devices. I strongly suspect this is what you may see.

Can you please check it out and if if it's indeed the case (and about 8GB of the 10GB is successfully dumped) then its as things should be.

nikolindima commented 9 months ago

run: pcileech.exe -device fpga dump -v

2024-02-07 10 34 17

ufrisk commented 9 months ago

👍 I'm happy to see the issue is resolved. This is quite normal behavior due to the way addressing is set up on the PC platform.