ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

Exception in VmmCacheReserve #48

Closed fwdevv closed 6 years ago

fwdevv commented 6 years ago

When i'm reading memory in a fast loop i get this error after about 25 reads

Image

my code :

VmmProcInitialize(ctx);
PVMM_CONTEXT ctxVmm = (PVMM_CONTEXT)ctx->hVMM;
PVMM_PROCESS proc = VmmProcessGet(ctxVmm, procId);

while (1) {
    int num;
    VmmRead(ctxVmm, proc, address, &num, sizeof(num));

    printf("%d\n", num);

    Sleep(150);
}

thanks for any help

ufrisk commented 6 years ago

Thanks for reporting this memory corruption issue. I'll try to look into it, but it may take some days or weeks unfortunately (lack of time right now).

ufrisk commented 6 years ago

Can you please try the following code snippet instead to see if it's working better?

I'm not sure it's the problem that is why it would be interesting to see if the problem goes away if you test this. The Vmm* functions aren't really thread safe, and there is an internal updater thread in there doing some periodic upkeeping. The file system functions and the updater thread both competes for the lock inside PCILeech, but you're not doing that. That may (or may not) be the reason for this issue.

VmmProcInitialize(ctx);
PVMM_CONTEXT ctxVmm = (PVMM_CONTEXT)ctx->hVMM;
PVMM_PROCESS proc;

while (1) {
    int num;
    EnterCriticalSection(&ctxVmm->MasterLock);
    proc = VmmProcessGet(ctxVmm, procId);
    VmmRead(ctxVmm, proc, address, &num, sizeof(num));
    LeaveCriticalSection(&ctxVmm->MasterLock);

    printf("%d\n", num);

    Sleep(150);
}
ufrisk commented 6 years ago

I suspect this issue has to do with the lack of synchronization over the VMM functionality - which does not support multi-threaded access by default. If this problem should still be an issue even after the lock is applied - or in the DLL I just made available please re-open the issue.

fwdevv commented 6 years ago

your fix seems to work thank you very much

ufrisk commented 6 years ago

Awesome, thanks for letting me know.

Also you might be interested in the DLL if it better suits your needs.