GithubHelp home page GithubHelp logo

Physical and virtual adresses about pcileech HOT 36 CLOSED

ufrisk avatar ufrisk commented on August 25, 2024
Physical and virtual adresses

from pcileech.

Comments (36)

ufrisk avatar ufrisk commented on August 25, 2024 2

I'll add this in the next release of PCILeech. I have other features to complete before release as well so it may take some time.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024 1

Unfortunately that is not implemented outside the memory process file system (mount command) at the moment.

It's quite complex to do this, but it may be possible for you to modify the code to do so without relying on the mount command.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

The phys2virt command line option is operating system independent as long as the target runs on the x64 CPU architecture.

I currently do not have a command line option for the reverse, even though you're not the first to ask. It would be a rather generic page table walk, you would have the CR3/PML4 address and the Virtual Address as input and the Physical Address at the output.

I'll look into possibly adding it, but for now you'll have to do a manual page table walk for it (please consult intel manuals for this).

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

For function Action_PT_Phys2Virt you need to input cr3 and if i understand correctly each process have its own cr3/pml4 address right ? How do i get this cr3 address for specific process?

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

This is not supported at the moment. You should probably be able to use volatility for this if you have the memory dump though. I might implement some functionality helping with this in the not too distant future.

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

Ok I will be waiting. Thank you ufrisk.

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

Thank you so much for the update. Now there is pt_virt2phys. Witch function i need to use to get cr3 for specific process? Another question is spartan cards latency better then usb3380? How many read/write calls would i be able to do in 1 sec?

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

The easiest way, if using the USB3380, is probably to dump all memory with the USB3380 via a kernel module to a dump file. Then run pcileech mount -device <name_of_your_dump_file> and look into the process tree, There you'll find a file named PML4 in each process directory that contains the page directory base. It also contains a virt2phys file more described in my blog entry here: http://blog.frizk.net/2018/03/memory-process-file-system.html

Two reasons why the USB3380 is not supported.
(1) it's only capable of handling 32-bit DMA, which in reality will make it a huge problem.
(2) even if latencies are similar I'm able to read up to around 32 4096 byte pages at different addresses in one sweep using the FPGA, while they would have to be sequential with the USB3380, which in reality would turn it into 32 different reads. If using a kernel module the performance impact would be even larger.

But it should work with the file approach. You just won't be able to edit live memory via the process file system, but otherwise it should work in read-only mode.

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

I got some problem with kernel module. You know what could be the problem ?
http://prntscr.com/iuwo1i

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

you need to dump the memory to the file before you can use it, running the dump command., in your case pcileech.exe dump -out dumpmem1.raw -kmd 0x7fffC000

also when using the mount command against a file only specify the file in the device option, no need to specify kmd address too. pcileech.exe mount -device dumpmem1.raw

also you specify the wrong kmd address, please read the output about the address where it's loaded.

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

Run into same problem here http://prntscr.com/iuytu5 saying no kernel module.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

can you please run the identify command as it says in the printscreen you posted?

pcileech identify -device dumpmem1.raw

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

Sorry i though identify option don't work on usb3380. Still have kernel module problem http://prntscr.com/iv0omh && pid folder is empty. Sorry for bothering you.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

Can you please try to re-run your last command and also add the -vv option for extra verbose. There will be a short hexdump I need to see together with some other output.

I believe you might possibly have tripped over a bug I fixed in the not yet released next version (I just want to confirm if that is the case). If thats the case I could send you a pre-release binary.

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

D:\Users\Zibux\Desktop\pcileech-master\pcileech_files>pcileech.exe mount -device dumpmem1.raw -cr3 0x1ab000 -vv

MOUNT: INFO: FILES folder not mounted. (No kernel module loaded).
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 000000010307a000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff566777ff566777 at PA: 00000001b54e6000 i: 2
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff526373ff526373 at PA: 00000001b54e6000 i: 10
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff506171ff506171 at PA: 00000001b54e6000 i: 13
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff526373ff526373 at PA: 00000001b54e6000 i: 25
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff526373ff526373 at PA: 00000001b54e6000 i: 26
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff516272ff526373 at PA: 00000001b54e6000 i: 27
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff536677ff506171 at PA: 00000001b54e6000 i: 30
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff38414aff5b6773 at PA: 00000001b54e6000 i: 33
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff798696ff101823 at PA: 00000001b54e6000 i: 34
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff879db2ff859db7 at PA: 00000001b54e6000 i: 37
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff859db7ff859db7 at PA: 00000001b54e6000 i: 38
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff859db7ff859db7 at PA: 00000001b54e6000 i: 39
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff859db7ff859db7 at PA: 00000001b54e6000 i: 40
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff859db7ff859db7 at PA: 00000001b54e6000 i: 41
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff869fb5ff869fb5 at PA: 00000001b54e6000 i: 42
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff869fb5ff869fb5 at PA: 00000001b54e6000 i: 43
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff869fb5ff869fb5 at PA: 00000001b54e6000 i: 44
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 00000001b54e6000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 000000007d5e5000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ffee0e4de81075ff at PA: 000000005d5e4000 i: 0
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 0c75ff1075ff0ceb at PA: 000000005d5e4000 i: 1
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 1d74f6855959f08b at PA: 000000005d5e4000 i: 5
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 658ba2e035ffce8b at PA: 000000005d5e4000 i: 7
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 8bf63302eb653a99 at PA: 000000005d5e4000 i: 9
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 08458bec8b55c365 at PA: 000000005d5e4000 i: 11
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 75c08459fff44d29 at PA: 000000005d5e4000 i: 13
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ee75f68518768b07 at PA: 000000005d5e4000 i: 14
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ec8b55c35d5ec68b at PA: 000000005d5e4000 i: 15
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE eb24708b5608458b at PA: 000000005d5e4000 i: 16
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 86e80875ffec8b55 at PA: 000000005d5e4000 i: 20
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE d28559d08bffff6f at PA: 000000005d5e4000 i: 21
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 703928428b0c718b at PA: 000000005d5e4000 i: 23
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE eb75d28559d08bff at PA: 000000005d5e4000 i: 25
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE c7fffceafee8f18b at PA: 000000005d5e4000 i: 28
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE c033c35dffffffc1 at PA: 000000005d5e4000 i: 34
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 758b56ec8b55c35d at PA: 000000005d5e4000 i: 35
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 000000005d5e4000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 45f6fffff90ce8f1 at PA: 000000003b0e2000 i: 2
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 56ec8b550004c25d at PA: 000000003b0e2000 i: 6
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE f538e80c4e8df18b at PA: 000000003b0e2000 i: 7
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE f530e8044e8dffff at PA: 000000003b0e2000 i: 8
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE f2e864d7b33001c7 at PA: 000000003b0e2000 i: 16
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 020b41e83c76ff09 at PA: 000000003b0e2000 i: 18
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 560774010845f6ff at PA: 000000003b0e2000 i: 20
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 560774010845f659 at PA: 000000003b0e2000 i: 30
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 0000d4a0ff5d5e01 at PA: 000000003b0e2000 i: 37
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 8e8b1474c085006f at PA: 000000003b0e2000 i: 41
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 00d8a0ff5d5e018b at PA: 000000003b0e2000 i: 43
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 8b55ff79d669e95d at PA: 000000003b0e2000 i: 46
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 8b53fc4589c53365 at PA: 000000003b0e2000 i: 48
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE f18bff335756085d at PA: 000000003b0e2000 i: 49
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 8459ff681afee857 at PA: 000000003b0e2000 i: 50
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE d045c7f07d8dd87d at PA: 000000003b0e2000 i: 53
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 50f0458d5053f48b at PA: 000000003b0e2000 i: 55
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 000000003b0e2000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 000000004c5e1000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE cb8b4810588b4807 at PA: 00000001d5660000 i: 3
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 45e8ce8b49d3ffcf at PA: 00000001d5660000 i: 5
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE c64979c085fff887 at PA: 00000001d5660000 i: 6
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 248c110f1048100f at PA: 00000001d5660000 i: 12
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 40248c8d48001cd9 at PA: 00000001d5660000 i: 14
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE fffb13f8e8000001 at PA: 00000001d5660000 i: 15
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 90fff3ef19e80141 at PA: 00000001d5660000 i: 18
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ce8b49fff36edbe9 at PA: 00000001d5660000 i: 19
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE fff36f16e990d6ff at PA: 00000001d5660000 i: 26
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE abf615ffce8b49ff at PA: 00000001d5660000 i: 36
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 485024448d4c0011 at PA: 00000001d5660000 i: 37
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 6ee6e990d6ff41cb at PA: 00000001d5660000 i: 39
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 4101202444c6fff3 at PA: 00000001d5660000 i: 40
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 058d4c000002b2b9 at PA: 00000001d5660000 i: 41
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 202484110f00100f at PA: 00000001d5660000 i: 44
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 0f1048100f000001 at PA: 00000001d5660000 i: 45
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE c6e990d6ff41cb8b at PA: 00000001d5660000 i: 51
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 00000001d5660000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 49076f12ff06e9ed at PA: 00000001bbb5f000 i: 1
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 12ff11bce94012ff at PA: 00000001bbb5f000 i: 5
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 5a697fffff09076f at PA: 00000001bbb5f000 i: 6
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ff12ffc612ff3f3b at PA: 00000001bbb5f000 i: 7
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 48357401a8f07d89 at PA: 00000001bbb5f000 i: 11
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 74505d3949ff588b at PA: 00000001bbb5f000 i: 12
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE fb81660b5bb70f5f at PA: 00000001bbb5f000 i: 13
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 48fffceb90e8e875 at PA: 00000001bbb5f000 i: 16
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 408b48d1ebf07d8b at PA: 00000001bbb5f000 i: 17
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 20e8c148c7004a17 at PA: 00000001bbb5f000 i: 18
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 0000b8485053d85d at PA: 00000001bbb5f000 i: 20
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE fbc25101f2007803 at PA: 00000001bbb5f000 i: 23
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 48f20740100ff2c3 at PA: 00000001bbb5f000 i: 25
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 7001f88348c02c0f at PA: 00000001bbb5f000 i: 26
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE c148f04533c08b0b at PA: 00000001bbb5f000 i: 27
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 00790419003cc707 at PA: 00000001bbb5f000 i: 44
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 000010894855001d at PA: 00000001bbb5f000 i: 45
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 00000001bbb5f000
VmmProc: INFO: Kernel Base located at fffff8016a476000.
VmmProc: INFO: PsInitialSystemProcess located at fffff8016a83b1e0.
VmmProc: INFO: EPROCESS located at ffffe000cd249040.
vmmproc.c!VmmProcWindows_OffsetLocatorEPROCESS: 00000000001ab000 ffffe000cd249040
0000 03 00 b6 00 00 00 00 00 48 90 24 cd 00 e0 ff ff ........H.$.....
0010 48 90 24 cd 00 e0 ff ff 58 90 24 cd 00 e0 ff ff H.$.....X.$.....
0020 58 90 24 cd 00 e0 ff ff 00 b0 1a 00 00 00 00 00 X.$.............
0030 38 7b 2b cd 00 e0 ff ff 38 03 8f d4 00 e0 ff ff 8{+.....8.......
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0050 01 00 14 00 00 00 00 00 0f 00 00 00 00 00 00 00 ................
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00f0 00 00 00 00 00 00 00 00 38 91 24 cd 00 e0 ff ff ........8.$.....
0100 38 91 24 cd 00 e0 ff ff 00 00 00 00 00 00 00 00 8.$.............
0110 14 00 14 00 00 00 00 00 05 00 00 00 00 00 00 00 ................
0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01b0 00 00 00 00 00 00 00 00 01 01 00 00 08 06 00 00 ................
01c0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0230 00 00 00 00 00 00 00 00 00 00 00 00 b0 05 00 00 ................
0240 80 2a eb ce 00 e0 ff ff 00 1b 7a 6a 01 f8 ff ff .*........zj....
0250 05 d0 c6 32 3d 00 00 00 0f 5f 36 00 00 00 00 00 ...2=...._6.....
0260 00 00 00 00 00 00 00 00 00 00 00 00 27 11 00 00 ............'...
0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0290 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02a0 00 00 00 00 00 00 00 00 01 00 06 00 00 00 00 00 ................
02b0 f0 92 24 cd 00 e0 ff ff f0 92 24 cd 00 e0 ff ff ..$.......$.....
02c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02e0 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ................
02f0 30 2b eb ce 00 e0 ff ff 80 53 79 6a 01 f8 ff ff 0+.......Syj....
0300 00 d0 02 02 00 0c 04 14 4e da 57 6a f4 c1 d3 01 ........N.Wj....
0310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0330 00 d0 ac 4d 00 00 00 00 00 d0 10 23 00 00 00 00 ...M.......#....
0340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0350 00 00 00 00 00 00 00 00 6f 6a 21 d6 01 c0 ff ff ........oj!.....
0360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0390 00 00 00 00 00 00 00 00 ac 27 02 00 00 00 00 00 .........'......
03a0 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @...............
03b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03c0 00 00 00 00 00 00 00 00 0b a9 d9 03 00 00 00 00 ................
03d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0410 40 f0 7b 6a 01 f8 ff ff 00 40 21 d6 01 c0 ff ff @.{j.....@!.....
0420 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0430 20 66 21 d6 01 c0 ff ff 00 00 00 00 00 00 00 00 f!.............
0440 00 00 00 00 00 00 00 00 53 79 73 74 65 6d 00 00 ........System..
0450 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 ................
0460 70 e1 20 cd 00 e0 ff ff 00 00 00 00 00 00 00 00 p. .............
0470 00 00 00 00 00 00 00 00 00 00 ff ff ff 7f 00 00 ................
0480 d0 7e 2b cd 00 e0 ff ff d0 06 8f d4 00 e0 ff ff .~+.............
0490 bd 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 ................
04a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04b0 e5 00 00 00 00 00 00 00 17 02 00 00 00 00 00 00 ................
04c0 73 95 01 00 00 00 00 00 5e e7 6b 1e 00 00 00 00 s.......^.k.....
04d0 88 35 fd 08 00 00 00 00 dc d7 2b 00 00 00 00 00 .5........+.....
04e0 00 00 00 00 00 00 00 00 8b 02 00 00 00 00 00 00 ................
04f0 1e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

VmmProc: Unable to locate EPROCESS offsets.
MOUNTING PCILEECH FILE SYSTEM:

PCILeech Memory Process File System is mounted in the /proc/ folder.
Memory from dump files or PCILeech hardware DMA devices is analyzed to provide
a convenient process file system.

  • File system is read-only when dump files are used.
  • File system is read-write when FPGA hardware acquisition devices are used.
  • Full support exists for some x64 Windows operating systems.
  • Limited support for all other x64 operating systems.
    ===============================================================================
    MOUNT: Mounting as drive K:\

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

yeah, it's the bug, can you please try the more recent dev version at:
https://mega.nz/#!IX4UFBRK!UWp5tVERKGtx6d6XUYyQRE4Riqhw5GYn98XTO5U0EgI

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

Tried dev version getting same stuff. On one dump file kernel error dispersed but folders still empty.

D:\Users\Zibux\Desktop\newdevversion>pcileech.exe mount -device dumpmem1.raw -cr3 0x1ab000 -vv

MOUNT: INFO: FILES folder not mounted. (No kernel module loaded).
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 0000000144dc5000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 001f8c80fe2007f1 at PA: 00000000d54c4000 i: 2
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 0103f0000007f003 at PA: 00000000d54c4000 i: 3
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 5c68100000270701 at PA: 00000000d54c4000 i: 4
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 0103f0000007f005 at PA: 00000000d54c4000 i: 9
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 3858103f00070101 at PA: 00000000d54c4000 i: 11
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 3868104780070101 at PA: 00000000d54c4000 i: 19
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 5c68100000270101 at PA: 00000000d54c4000 i: 20
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 009f9882fe240ff1 at PA: 00000000d54c4000 i: 26
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 5c68100000170207 at PA: 00000000d54c4000 i: 28
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 001fc400ffa007ed at PA: 00000000d54c4000 i: 30
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 4bbd83b80057ff1f at PA: 00000000d54c4000 i: 31
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 4c68103800570401 at PA: 00000000d54c4000 i: 33
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 001fc800ff0007e5 at PA: 00000000d54c4000 i: 34
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 4bb483b80083ff17 at PA: 00000000d54c4000 i: 37
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 001ff400fe0007ed at PA: 00000000d54c4000 i: 38
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 5c6017800ff70101 at PA: 00000000d54c4000 i: 43
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 386013bf80070101 at PA: 00000000d54c4000 i: 45
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 00000000d54c4000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 16e3bf800000bf7b at PA: 00000000529c3000 i: 1
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE bd1e3d77cbcd3ea5 at PA: 00000000529c3000 i: 4
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE bcc6bf800000bf71 at PA: 00000000529c3000 i: 5
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE f2a83d65f6983ee3 at PA: 00000000529c3000 i: 8
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 8c5b3d943deb3ee7 at PA: 00000000529c3000 i: 10
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE ec71bf800000bf63 at PA: 00000000529c3000 i: 11
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 74db3d6668953f07 at PA: 00000000529c3000 i: 12
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 141ebf800000bf57 at PA: 00000000529c3000 i: 15
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 04373d8313f53f17 at PA: 00000000529c3000 i: 16
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 70ef3d8f1fda3f21 at PA: 00000000529c3000 i: 20
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE f742bf800000bf45 at PA: 00000000529c3000 i: 21
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 8b1c3d85c8c13f21 at PA: 00000000529c3000 i: 22
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 4755bf800000bf45 at PA: 00000000529c3000 i: 23
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE bb923d8438b93f1f at PA: 00000000529c3000 i: 24
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 2192bf800000bf47 at PA: 00000000529c3000 i: 25
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE f22e3d7535d93f1f at PA: 00000000529c3000 i: 26
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE f1ecbf800000bf47 at PA: 00000000529c3000 i: 27
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 00000000529c3000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 01d0ed70268f1993 at PA: 00000001d40c2000 i: 28
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 00000001d40c2000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 00000001a15c1000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE b6592384750270bb at PA: 00000000ac640000 i: 1
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE 6d4e624f03020151 at PA: 00000000ac640000 i: 162
VMM: vmm.c!VmmTlbPageTableVerify: BAD PTE a19c227575eacda9 at PA: 00000000ac640000 i: 163
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 00000000ac640000
VMM: vmm.c!VmmTlbPageTableVerify: BAD PT PAGE at PA: 0000000049cbe000
VmmProc: INFO: Kernel Base located at fffff802c401a000.
VmmProc: INFO: PsInitialSystemProcess located at fffff802c43df1e0.
VmmProc: INFO: EPROCESS located at ffffe00123e43500.
vmmproc.c!VmmProcWindows_OffsetLocatorEPROCESS: 00000000001ab000 ffffe00123e43500
0000 03 00 b6 00 00 00 00 00 08 35 e4 23 01 e0 ff ff .........5.#....
0010 08 35 e4 23 01 e0 ff ff 18 35 e4 23 01 e0 ff ff .5.#.....5.#....
0020 18 35 e4 23 01 e0 ff ff 00 b0 1a 00 00 00 00 00 .5.#............
0030 38 d3 f0 23 01 e0 ff ff 38 79 b7 28 01 e0 ff ff 8..#....8y.(....
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0050 01 00 14 00 00 00 00 00 0f 00 00 00 00 00 00 00 ................
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00f0 00 00 00 00 00 00 00 00 f8 35 e4 23 01 e0 ff ff .........5.#....
0100 f8 35 e4 23 01 e0 ff ff 00 00 00 00 00 00 00 00 .5.#............
0110 14 00 14 00 00 00 00 00 0f 00 00 00 00 00 00 00 ................
0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01b0 00 00 00 00 00 00 00 00 01 01 00 00 08 06 01 00 ................
01c0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0230 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 00 ............p...
0240 80 f2 a7 25 01 e0 ff ff 00 5b 34 c4 02 f8 ff ff ...%.....[4.....
0250 18 94 bd 2f 0f 00 00 00 38 d5 10 00 00 00 00 00 .../....8.......
0260 00 00 00 00 00 00 00 00 00 00 00 00 8a 04 00 00 ................
0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0290 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02a0 00 00 00 00 00 00 00 00 01 00 06 00 00 00 00 00 ................
02b0 b0 37 e4 23 01 e0 ff ff b0 37 e4 23 01 e0 ff ff .7.#.....7.#....
02c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02e0 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ................
02f0 30 f3 a7 25 01 e0 ff ff 80 93 33 c4 02 f8 ff ff 0..%......3.....
0300 00 d0 02 02 00 0c 04 14 b8 1e a9 70 d7 c2 d3 01 ...........p....
0310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0330 00 d0 75 09 00 00 00 00 00 d0 75 09 00 00 00 00 ..u.......u.....
0340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0350 00 00 00 00 00 00 00 00 6b 6a a1 17 00 c0 ff ff ........kj......
0360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0390 00 00 00 00 00 00 00 00 01 8c 00 00 00 00 00 00 ................
03a0 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @...............
03b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03c0 00 00 00 00 00 00 00 00 65 1a ae 40 00 00 00 00 ........e..@....
03d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0410 40 30 36 c4 02 f8 ff ff 00 40 a1 17 00 c0 ff ff @06......@......
0420 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0430 20 66 a1 17 00 c0 ff ff 00 00 00 00 00 00 00 00 f..............
0440 00 00 00 00 00 00 00 00 53 79 73 74 65 6d 00 00 ........System..
0450 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 ................
0460 30 a4 e2 23 01 e0 ff ff 00 00 00 00 00 00 00 00 0..#............
0470 00 00 00 00 00 00 00 00 00 00 ff ff ff 7f 00 00 ................
0480 d0 d6 f0 23 01 e0 ff ff d0 7c b7 28 01 e0 ff ff ...#.....|.(....
0490 b4 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 ................
04a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04b0 51 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 Q.......X.......
04c0 cc 99 00 00 00 00 00 00 4e f3 7f 0a 00 00 00 00 ........N.......
04d0 ae c6 98 04 00 00 00 00 36 c8 03 00 00 00 00 00 ........6.......
04e0 00 00 00 00 00 00 00 00 69 00 00 00 00 00 00 00 ........i.......
04f0 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 i...............

VmmProc: Unable to locate EPROCESS offsets.
MOUNTING PCILEECH FILE SYSTEM:

===============================================================================
PCILeech Memory Process File System is mounted in the /proc/ folder.
Memory from dump files or PCILeech hardware DMA devices is analyzed to provide
a convenient process file system.

  • File system is read-only when dump files are used.
  • File system is read-write when FPGA hardware acquisition devices are used.
  • Full support exists for some x64 Windows operating systems.
  • Limited support for all other x64 operating systems.
    ===============================================================================
    MOUNT: Mounting as drive K:\

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

this is hard for me to look into here as-is, are you able to provide the memory dump somehow so that I may look into it and try to identify the problem?

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

Where can i dm you google drive link ? Thanks for helping me out.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

@UlfFrisk at twitter or Telegram if you prefer it, alternatively drop and email to [email protected]

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

I sent dump to email.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

Thanks, I found some issues which I hope should now be resolved.

If you can test
https://mega.nz/#!wKhgVJ4Z!jLPjFqPowQLxFdUCW2-0pygaCmhle0fCC9fNqFp_fRk
with pcileech -device dumpmem1.raw it should now work.

You should be able to click into each process, and read the PML4/CR3 in the PML4 file. Or eaven easier if you wish to convert virtual memory to physical memory just write the virtual memory address into the file K:\proc\name<your_process>\virt2phys\virt
The physical address should now be shown in the phys file, also the map file contains the page directories and some other information. Also the page file contains the page binary data at the physical address.

Please let me know if this works or not, and if you have any additional questions or improvements suggestions.

from pcileech.

Zibux avatar Zibux commented on August 25, 2024

Works perfect! Thank you very much for help :) .

from pcileech.

kdezz avatar kdezz commented on August 25, 2024

hi @ufrisk how could i access/find pml4/cr3 for specific process? how can i scan for this? i know it is in the code someplace because you do it in dokan/mount system inside the file, but i need to do this without relying on mount. thx.

from pcileech.

kdezz avatar kdezz commented on August 25, 2024

i've done this overnight :) nice simple c code, very readable over time. comments when needed, without many knowledge of sys internals i can make nice changes. in fact i recommend to keep it like it is, i think such feature would cause bloat, you would be adding them everywhere. people who need it can implement it when reading your code for only some hours.

from pcileech.

kdezz avatar kdezz commented on August 25, 2024

@ufrisk noticed bug. not difference between x64 and x86 peb scan so x86 process = bad/short module list. im fix and maybe push.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

not really a bug, but a lack of feature. the 32-bit PEB and modules parsing is missing for WoW64-processes (commonly known as 32-bit processes). Only the 64-bit part of those processes are parsed in the PEB and modules list.

I haven't gotten around to add it, a pull req would be awesome :) if you decide to go ahead looking into it can you please parse the 32-bit PEB into the file win-peb32 (or something like that) and keep the 64-bit PEB around as-is?

from pcileech.

kdezz avatar kdezz commented on August 25, 2024

i did try to implement it in rush but now im gone for some days so couldn't make it, will work on it when back. had trouble finding the wow64 peb, should be 0x1000 behind/on front but wasn't. can i ask is wow64 peb using x64 structure still? surprise not much info about wow64 pebs

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

64-bit peb is used for 64-bit ntdll, wowcpu and other 64-bit dlls, so I'd rather keep it as-is. The 64-bit stuff is used, when syscall is to be made the thread moves into 64-bit long mode and 64-bit ntdll before calling into kernel. I read somewhere that 32-bit peb is now randomized on latest win10, but I haven't done much research on it.

from pcileech.

kdezz avatar kdezz commented on August 25, 2024

so i think easy way is to create form of signature for 32-bit peb (since randomize like u say) but im not find it via typical method (both ntqueryinformationprocess and teb->peb). i thought that ntqueryinformationprocess->peb is x64 and teb->peb are the x86 but its not from test. any idea how to get 32-bit/x86/wow64 peb so i can create signature or investigate.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

teb->peb should get you the 32-bit one (in a test application) or did they change that one as well in recent builds? once you have the address of the 32-bit peb I suspect there should be a ptr somewhere pointing to it...

I haven't really looked into this, it's been (and still is) on my todo list, I just have other things to look into first ...

from pcileech.

kdezz avatar kdezz commented on August 25, 2024

seem like it here. i think they change it again. any recommend for what pattern to search to fine 32-bit peb? if not no worry i will keep trying.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

@kdezz I'll probably push support for this to github some time next week or the week after that together with a few other new capabilities. It seems like the 32-bit PEB is located +/- 0x1000 from the 64-bit PEB depending on OS version.

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

@kdezz I hope 32-bit process support (not operating system support) is working as it should now. Please let me know otherwise.

from pcileech.

Asdf144 avatar Asdf144 commented on August 25, 2024

It doesnt unfortunately :(
It doesnt find the Module :/ on 64bit processes everything is working

from pcileech.

ufrisk avatar ufrisk commented on August 25, 2024

This should be working and be resolved now. Closing issue.

from pcileech.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.