ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

Hot-swappable PCIe not working #43

Closed ralphje closed 5 years ago

ralphje commented 6 years ago

I have been experimenting with pcileech to attempt a memory dump while the machine is still active. However, I have not yet been able to successfully access the memory while hot-swapping the PCIe hardware.

I have access to the PCIeScreamer and AC701/FT601. I have flashed both using the latest pcileech firmware. I have been able to use both cards in the situation where I turn of the target system, insert the PCIe card, and restart the target system. I have successfully created memory dumps and modified the Windows unlock password, for instance.

However, I have not been able to do this while the system is running. Even when the cards are inserted in a running system, the system appears to require a reboot before the software is able to read memory.

(Probably unrelated, but moreover, after a successful read-out, a further reboot of the target system will disallow reading memory again: the PCIe cards appear to require a power cycle to be able to read again.)

The target OS does not seem to matter here, both Windows and Linux have been attempted. My target systems include HP ProLiant and Dell PowerEdge servers.

Is this supported? If so, do you have tips on how to get this working? I'd be happy to provide you with more details if you so require.

ufrisk commented 6 years ago

I haven't looked into PCIe hotswap with the FPGA hardware I'm using. I managed to get it working with the USB3380 hardware I used before, like once or twice, but that was after like trying many more times without success.

PCIe hotswap is a bit hit and miss, depending on the target hardware. I guess server hardware should be quite likely to support PCIe hotswap but this is not something I have been able to test. I do not have easy access to server hardware myself and this in combination with this being a hobby project means that I haven't been able to investigate this.

If you are able to sleep your target system it's however quite easy to connect the device while the computer is in sleep and then it will work when the system is woken up.