Comments (6)
I haven't updated the ntfs-style signatures for a while. Also, as-is they are a bit flimsy if they are working with more recent Windows builds. I might look into this again in the not too distant future though, and possibly generate a few new signatures. To look into exact your version I probably would need a copy of it since the more recent Windows build seems to have a more recent one. I also plan to look into some other methods of kernel injects in the not too distant future if I have time. If you can provide a link to your ntfs.sys I can possibly look into it.
about the kernel module, the generic approach win10_x64
sometimes work a little bit better if you wait 30 seconds or so after the computer is booted to the logon screen. Once loaded you can try to pop a system shell using: pcileech.exe wx64_pscmd -kmd 0x<address_of_kernel_module>
I have noticed that the mount command (to mount the filesystem) is sometimes a bit unstable and may bluescreeen the computer. I'm currently trying to pinpoint the error.
pcileech.exe mount -device c:\temp\memdump_win10.raw
tries to mount the memory process file system from a memory dump file from c:\temp... It has nothing to do with loading any kernel modules. If the memdump_win10.raw does not exist it will fail.
To dump all memory, take note of the max physical address in the probe. Then run:
pcileech.exe dump -v -force -out yourdumpfile.raw -max 0x<your_max_probe_address>
Alternatively if you wish to mount the memory process file system from a computer (and not the file system mount which requires a kernel module) just run: pcileech.exe mount -max 0x<your_max_probe_address>
from pcileech.
can you please send me your ntfs.sys file and I'll look into it.
from pcileech.
Sorry about the dump command being without the use of a kmd, I was remembering wrong. Of course it won't matter if the command is being run without using the kmd.
Where would you like for me to upload ntfs.sys
? Not sure if you want me "polluting" your project with copyrighted material (by uploading it attached to this issue). Should I just upload to megaupload/dropbox and drop you a link via twitter?
from pcileech.
yeah, mega or dropbox is fine
from pcileech.
strange, the file you sent me, which is the most recent Windows 10 one shows Product version 10.0.16299.248 if you right click on it. It's the same SHA256 hash though. Anyway, the update should be on Github now. Hope this one works better.
it's probably best just to go for a regular memory scan insert - pcileech.exe kmdload -kmd win10x64_ntfs_20180210_16299
The current PCILeech have a bug that makes it very slow when encountering unreadable memory with the PCIeScreamer, such as the memory area between 3-4GB. You may wish to try: pcileech.exe kmdload -kmd win10x64_ntfs_20180210_16299 -min 0x100000000
to speed things up.
from pcileech.
Thanks, I will test this more when I get home. The pciescreamer card was not really that stable yesterday (would not show up in device manager etc), so I couldn't test it whne you released it. I'll try moving the card to a different pcie slot and see if it's more willing to cooperate.
I'll close this issue, since its likely that you have fixed the problem.
from pcileech.
Related Issues (20)
- DEVICE: FPGA: ERROR: Unable to retrieve required Device PCIe ID [4,v4.10,0000] HOT 1
- Hi, I'm having some problems initializing the device HOT 11
- Mouse&Keyboard status HOT 1
- read memory size and data problem HOT 3
- After time a module fetched will become unavailable HOT 2
- How to find information about a shared memory section HOT 2
- Using pcileech to move mouse HOT 1
- pci squirrel (Failed to connect to the device.) HOT 4
- DMA freezes every few seconds HOT 4
- Unable to retrieve required Device PCIe ID [4,v4.7,0000,FWCUST] HOT 2
- AMD + Screamer PCIe Squirrel: Probe reads 10% then fails subsequently HOT 1
- ERROR: PCILeech Invalid LeechDMA version number HOT 10
- PCILEECH: Failed to connect to the device. HOT 3
- M.2 Screamer Issue HOT 1
- May I ask if the shell code (WINX64_STAGE23_VMM3) of kmd has an active code? HOT 3
- Can the project be compiled to Linux to use to attack Windows HOT 1
- Specify PageDirectoryBase (DTB/CR3) in -dtb option if value if known. HOT 1
- Can't read anything HOT 1
- LeechAgent.exe not included in release HOT 1
- Connection to the board is lost after 1 use HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pcileech.