ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.87k stars 718 forks source link

Still read old value with NO CACHE #65

Closed false closed 5 years ago

false commented 5 years ago

Hi,

I have the following issue :

I use a 3.2 bin, 3.6.2 pcileech, and pciescreamer card. I am reading in a loop an ever changing value (it can not change, and change at all moment). My problem is after a while the read value stays unchanged, when it actually changed. It might be because of too many reads, I can hear windows beeps because of the usb3 FTDI bridge device losing connection/being reconnected now and then; And sometimes it just stops reading the current value. If the value changes again, then it catches up, but it will never read the value it stoped working on.

exemple : Reading 1, action of my app, value changing to 2, action of my app, 3 ... 4 ... Stopping/bugging/might be a brief ftdi disconnection issue, on 5 : 5 is never read. The PCILeech dll still reads 4 it never stops reading 4. Force changing the value to 6 through the target app : pcileech catchs up and reads 6.

I have tested PCILEECH_DEVICE_OPT_FPGA_DELAY_READ to avoid the problem, but only a very high (and slow) value like 100000 will fix the issue ; But it is too slow unfortunatly for my use. 10000 will still have issues for eg.

I have tried to play around with config settings, but can't get anything to solve this error.

My question is : How is it possible it still reads this value when it is supposed to not read in the cache (NO CACHE FLAG) ? Do you have an idea if I can change something in the lib ( VOID VmmReadEx(_Inout_ PVMM_CONTEXT ctxVmm, _In_ PVMM_PROCESS pProcess, _In_ QWORD qwVA, _Inout_ PBYTE pb, _In_ DWORD cb, _Out_opt_ PDWORD pcbReadOpt, _In_ QWORD flags) ? ) so it returns a read error instead of keeping returning the old value ? Or even better, managing to read the new value ?

I could indeed try to treat the read error if i could return it ; At the moment I have no information about the fact the current value is not the real one, as sometimes the value stays the same for a while in the target app and it can be a normal behaviour.

false commented 5 years ago

Not reproduced.