ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.76k stars 707 forks source link

Connection to the board is lost after 1 use #306

Closed Bo0m21 closed 3 weeks ago

Bo0m21 commented 1 month ago

Good day to all, I have encountered a very interesting problem that I can't solve yet. I configured the firmware on the board, ran all the tests and in general everything worked well. But then I noticed a strange feature, that after I read any data from the board, I can no longer connect to it.

I tested certain bion settings but the problem was not resolved, I will additionally test it on another firmware, but I think it will be the same.

It is important to note that I am using Gigabyte AMD with AM4 socket.

I have attached all the logs below, but deleted some of them. I ran the commands that I ran at once, first one, then the second, and got these results, which is very strange for me.

Who has encountered a similar situation?

PS C:\Users\Work-PC\source\repos\files> .\MemProcFS.exe -v -vv -device fpga
DEVICE: FPGA: ScreamerM2 PCIe gen1 x1 [300,25,500] [v4.13,0300] [ASYNC,NORM,FWCUST]

All fine ...

LcMemMap_AddRange: 0000000000000000-000000000009ffff -> 0000000000000000
LcMemMap_AddRange: 0000000000100000-0000000c3f37ffff -> 0000000000100000
LeechCore v2.18.7: Open Device: fpga
[CORE]     DTB  located at: 00000000001ad000. MemoryModel: X64
[CORE]     NTOS located at: fffff8044b600000
[CORE]     PsInitialSystemProcess located at fffff8044c2fc420
[CORE]     EPROCESS located at ffffcc01446cf080

All fine ...

[PROCESS]  OK: TRUE
[PROCESS]      PID:  440 PPID: 540 STAT: 004 DTB:  028 DTBU: 390 NAME: 5a8 PEB: 550
[PROCESS]      FLnk: 448 BLnk: 450 oMax: 858 SeAu: 5c0 VadR: 7d8 ObjT: 570 WoW: 580
[PROCESS]  SYSTEM DTB: 00000000001ad000 EPROCESS: ffffcc01446cf080
[PROCESS]     # STATE  PID      DTB          EPROCESS         PEB          NAME

All fine ...

[INFODB]   INIT: SUCCESS: va=0xfffff8044b600000
[SYMBOL]   Initialized symbol subsystem (Microsoft).
Initialized 64-bit Windows 10.0.19041
[CORE]     VmmProc: Start periodic cache flushing
[PLUGIN]   LOAD: built-in module: '\'
[PLUGIN]   LOAD: built-in module: '\'
[PLUGIN]   LOAD: built-in module: '\forensic'
[PLUGIN]   LOAD: built-in module: '\files\handles'
[PLUGIN]   LOAD: built-in module: '\files\vads'
[PLUGIN]   LOAD: built-in module: '\files\modules'
[PLUGIN]   LOAD: built-in module: '\phys2virt'
[PLUGIN]   LOAD: built-in module: '\misc\phys2virt'
[PLUGIN]   LOAD: built-in module: '\handles'
[PLUGIN]   LOAD: built-in module: '\heaps'
[PLUGIN]   LOAD: built-in module: '\modules'
[PLUGIN]   LOAD: built-in module: '\memmap'
[PLUGIN]   LOAD: built-in module: '\minidump'
[PLUGIN]   LOAD: built-in module: '\threads'
[PLUGIN]   LOAD: built-in module: '\token'
[PLUGIN]   LOAD: built-in module: '\search\bin'
[PLUGIN]   LOAD: built-in module: '\misc\search\bin'
[PLUGIN]   LOAD: built-in module: '\search\yara'
[PLUGIN]   LOAD: built-in module: '\misc\search\yara'
[PLUGIN]   LOAD: built-in module: '\virt2phys'
[PLUGIN]   LOAD: built-in module: '\misc\bitlocker'
[PLUGIN]   LOAD: built-in module: '\conf'
[PLUGIN]   LOAD: built-in module: '\misc\eventlog'
[PLUGIN]   LOAD: built-in module: '\misc\procinfo'
[PLUGIN]   LOAD: built-in module: '\misc\view'
[PLUGIN]   LOAD: built-in module: '\sys'
[PLUGIN]   LOAD: built-in module: '\sys\drivers'
[PLUGIN]   LOAD: built-in module: '\sys\memory'
[PLUGIN]   LOAD: built-in module: '\sys\net'
[PLUGIN]   LOAD: built-in module: '\sys\objects'
[PLUGIN]   LOAD: built-in module: '\sys\pool'
[PLUGIN]   LOAD: built-in module: '\sys\proc'
[PLUGIN]   LOAD: built-in module: '\sys\services'
[PLUGIN]   LOAD: built-in module: '\sys\syscall'
[PLUGIN]   LOAD: built-in module: '\sys\sysinfo'
[PLUGIN]   LOAD: built-in module: '\sys\tasks'
[PLUGIN]   LOAD: built-in module: '\sys\users'
[PLUGIN]   LOAD: built-in module: '\registry'
[PLUGIN]   LOAD: built-in module: '\forensic\csv'
[PLUGIN]   LOAD: built-in module: '\forensic\files'
[PLUGIN]   LOAD: built-in module: '\forensic\findevil'
[PLUGIN]   LOAD: built-in module: '\forensic\hidden\handles'
[PLUGIN]   LOAD: built-in module: '\forensic\json'
[PLUGIN]   LOAD: built-in module: '\forensic\timeline'
[PLUGIN]   LOAD: built-in module: '\forensic\hidden\module'
[PLUGIN]   LOAD: built-in module: '\forensic\ntfs'
[PLUGIN]   LOAD: built-in module: '\forensic\prefetch'
[PLUGIN]   LOAD: built-in module: '\forensic\hidden\proc'
[PLUGIN]   LOAD: built-in module: '\forensic\hidden\registry'
[PLUGIN]   LOAD: built-in module: '\forensic\hidden\sys'
[PLUGIN]   LOAD: built-in module: '\forensic\hidden\thread'
[PLUGIN]   LOAD: built-in module: '\forensic\web'
[PLUGIN]   LOAD: built-in module: '\forensic\yara_builtin'
[PLUGIN]   LOAD: built-in module: '\findevil\EvKRNL1'
[PLUGIN]   LOAD: built-in module: '\findevil\EvKERNPROC1'
[PLUGIN]   LOAD: built-in module: '\findevil\EvPROC1'
[PLUGIN]   LOAD: built-in module: '\findevil\EvPROC2'
[PLUGIN]   LOAD: built-in module: '\findevil\EvPROC3'
[PLUGIN]   LOAD: built-in module: '\findevil\EvTHRD1'
[PLUGIN]   LOAD: built-in module: '\findevil\EvAV1'
[PLUGIN]   LOAD: built-in module: '\findevil\EvAPC1'
[PLUGIN]   LOAD: built-in module: '\sys\certificates'
[PLUGIN]   Load DLL: 'm_vmemd.dll'
[PLUGIN]   LOAD:  native  module: '\vmemd'
[PLUGIN]   Python initialization failed. Python 3.6 or later not found.
MOUNT: Failed. The required DOKANY file system library is not installed.
Please download from : https://github.com/dokan-dev/dokany/releases/latest
[CORE]     Exit periodic cache flushing

PS C:\Users\Work-PC\source\repos\files> .\MemProcFS.exe -v -vv -device fpga
DEVICE: FPGA: ERROR: Unable to connect to FPGA device [0,v0.0,0000]
MemProcFS: Failed to connect to memory acquisition device.
PS C:\Users\Work-PC\source\repos\files>
ufrisk commented 3 weeks ago

AMD have issues with DMA not working when doing out-of-bound reads. You can use a memmap to void this issue: https://github.com/ufrisk/LeechCore/wiki/Device_FPGA_AMD_Thunderbolt

That would resolve your issue most likely. Also for MemProcFS to work you'd have to install the Dokany file system driver from https://github.com/dokan-dev/dokany/releases/latest