search

ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

Failed finding entry point #38

Closed 0x4e38 closed 6 years ago

0x4e38 commented 6 years ago

Hi, I used pcileech to attack my dell laptop(xps, 13, 9360), but I got a error: "KMD: Failed. Failed finding entry point.", I found it's caused by returnning false value from "KMD_Win_SearchTableHalpInterruptController".

The page dumped by "pcileech pagedisplay -min 0x1000" as following: _Memory Display: Contents for address: 0x0000000000001000 0000 e9 4d 06 00 01 00 00 00 01 00 00 00 3f 00 18 10 .M..........?... 0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0020 00 00 00 00 00 00 00 00 00 00 00 00 00 9b 20 00 .............. . 0030 00 00 00 00 00 00 00 00 ff ff 00 00 00 93 cf 00 ................ 0040 00 00 00 00 00 00 00 00 ff ff 00 00 00 9b cf 00 ................ 0050 00 00 00 00 00 00 00 00 00 90 e1 61 00 00 00 00 ...........a.... 0060 7c 16 00 00 30 00 c6 16 00 00 10 00 00 00 00 00 |...0........... 0070 a0 fe 8f ad 03 f8 ff ff 00 90 00 40 d5 f7 ff ff ...........@.... 0080 06 01 07 00 06 01 07 00 01 09 00 00 00 00 00 00 ................ 0090 33 00 05 80 00 00 00 00 00 00 00 00 00 00 00 00 3............... 00a0 00 a0 1a 00 00 00 00 00 78 06 17 00 00 00 00 00 ........x....... 00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00e0 00 00 00 00 00 00 57 00 b0 5f 5f 9d 81 e2 ff ff ......W.._..... 00f0 00 00 00 00 00 00 ff 0f 00 30 5f 9d 81 e2 ff ff .........0....._

ufrisk commented 6 years ago

Which Windows version are you running? Windows 10? 1709?

Are you running any virtualization or virtualization based features such as Hyper-V, VMWare, VirtualBox, Credential Guard, Device Guard, Kernel Mode Code Integrity?

0x4e38 commented 6 years ago

Thanks, I disabled the "VMM" in BIOS and it works now.