search

ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.84k stars 715 forks source link

DMA freezes every few seconds #295

Closed Spuckwaffel closed 5 months ago

Spuckwaffel commented 6 months ago

Hey there, this is not really a bug, more like a general question. When using the DMA to father much data, via scatters and without every few seconds (5 or 6) the dma encounters a freeze for a small period of time (sometimes just a few ms, on bad startups even up to small seconds) and i dont have some proper explanation for that. I also dont think it has anything to do with the config settings and some caching changes like VMMDLL_OPT_CONFIG_TICK_PERIOD, VMMDLL_OPT_CONFIG_READCACHE_TICKS, VMMDLL_OPT_CONFIG_TLBCACHE_TICKS etc. do not change the behavior. My quesses are maybe overheating? Im not sure. Any ideas?

ufrisk commented 6 months ago

I've just updated the guide page about it: https://github.com/ufrisk/MemProcFS/wiki/FAQ_Timing#api-manually-refreshing-a-process-fast

It's probably best to disable internal refreshing and then perform the refreshes manually if you find the hiccup disturbing.

Let me know if this resolves your issue.

ufrisk commented 5 months ago

Since I haven't heard anything in a week I assume the updated guide entry resolved the issue.

Spuckwaffel commented 5 months ago

Hey there, sorry for the late reply. I have read your new guide and it's really helpful. However, is there no way to only refresh the VADs? I could set VMMDLL_OPT_REFRESH_FREQ_MEDIUM, but this will refresh the entire process list (which i don't need), network connections, Objects, Heaps will be cleared which are most likely still good with data. I'm mostly just reading data of one or two processes and the only thing that changes within the process are the memory pages and heap so im not really interested in flushing and rereading all the other stuff related to the process as i store that efficiently. Any ideas on how to focus only on VADs, TLB, etc? Also, I would still perform a MEDIUM refresh but wouldn't do that in such a frequent time, more like only every few minutes (unlike this is bad) and would do SLOW refreshes also way more less.

ufrisk commented 5 months ago

There is no way to refresh the VADs only.

Your point is rather moot though since all the "refresh" does is to throw away all old info. This is quick.

Things like VADs, Modules etc. are only re-generated on first access. If you never access the modules after a refresh they will never be regenerated so it won't incur any time.

On the other hand if the number of VADs are very large it's a rather slow operation, but it's what you want to refresh so there is no way around it I guess.