CPU Issue? about memprocfs HOT 10 CLOSED

I have not tested PCILeech/MemProcFS FPGA assisted memory acquisition on an AMD system, but I see no reason why it shouldn't work.

I might buy myself a new AMD system in the next few months so I'll be able to test this for sure though. Or maybe someone else on this forum already know?

from memprocfs.

@ufrisk I have a Ryzen 1700, Flare-X 3200mhz ram and a PCIe Screamer R02, works semi-stable.

I can't initialize the FPGA half the time with VMMDLL but when it manages to initialize, it works fine from that point.

If I probe with PCILeech multiple times it'll eventually disconnect / crash the FPGA and I'll have to reboot the machine to get it working again. If I'm just reading or writing memory it seems stable enough, was able to use MemProcFS without issues.

Sometimes I get a disconnection when bulk reading a lot of memory but I am able to unplug and plug in the USB again and it will carry on without having to reboot the machine.

from memprocfs.

I have the same problem with my AMD system.

AMD Ryzen 1600X, G-Skill 3200mhz ram.

XMP: Off
SVM: Off
IOMMU: Off

My PCIe Screamer won't even read anything on my AMD system.

from memprocfs.

Just want to make sure you tried the latest bitstream (v4.0).

But I'm assuming there is a problem with the Ryzens for some reasons. It's really hard for me to try to do locate the issue though without spending a lot of money on an AMD system. I might get one next year though.

from memprocfs.

i am using bitstream 4.0.
after the first read fails the whole system freezes up and i have to do a hard reboot.

On my intel system everything works just fine.

from memprocfs.

Please try the release just released. This should now be fixed. For best stability I would suggest starting MemProcFS with: MemProcFS.exe -device fpga -memmap auto on your Ryzen system.

Since this should now be fixed I'm closing the issue. If you should still experience any issues please let me know and re-open the issue.

from memprocfs.

I think I'm still having this issue.

I have a Ryzen 5800x, G.SKILL 3600MHz ram, a PCIE Screamer R04 and I'm using python api.

I initialized Vmm with '-memmap' and a 'physmemmap.txt' file obtained using Sysinternals RAMMap on target machine. My app works semi-stable, several functions may fail ocassionally and freeze the Screamer. I have to reboot the target machine to get it working again. Below is a list of functions that have caused my app to stuck. However, I'm not sure it's an AMD issue since I haven't tested my app on Intel CPUs (which I don't have).

Functions that may fail:

• memprocfs.Vmm()
• process.module()
• process.memory.read()

Also, the Wiki about this issue is not quite clear about the format of the memmap file. There are two types of sample files in the post. From my experience, the one without header is used by MemprocFS while the other is used by PCILeech. I think it may help to clarify that.

from memprocfs.

It's hard for me to know what the issue may be. If you have VT-d / IOMMU enabled somehow it may be that there are some lingering issues around that. Or it may be that your memory map isn't loaded due to the wrong format (or mistyping).

I'll update the guide pages around this to make it a lot clearer about the format of the file. Many thanks for the suggestion. Sometimes it's hard for me to see those things myself.

The memory map is fortunately a bit easy to check with:

I assume you initialize with:

import memprocfs
vmm = memprocfs.Vmm(['-device', 'fpga', '-memmap', 'c:\\your\\path\\to\\memmap.txt'])

if you wish to check if the memmap is properly loaded you may do (after memprocfs is initialized):

import leechcorepyc
lc = leechcorepyc.LeechCore('existing')
lc.memmap
# -> [{'base': 0, 'size': 6979321856, 'offset': 0}, {...}]

to enable lots of debug output at initialization you may also try the below. it will print it on the screen. I have a new more versatile logging module planned for next year but for now it's possible to do some printouts on the screen.

vmm = memprocfs.Vmm(['-device', 'fpga', '-memmap', 'c:\\your\\path\\to\\memmap.txt', '-v', '-vv', '-printf'])

from memprocfs.

I have IOMMU disabled.

I checked the memmap and it returned an empty list, so it seems I have a malformed memmap file. Below are the two formats I've tried, neither worked.

File 1:

0x1000      0xA0000
0x100000    0x9E00000
0xA000000   0xA200000
0xA20E000   0xBC360000
0xBDBFF000  0xBF000000
0x100000000 0x43F380000

File 2:

   #         Base            Top
--------------------------------
0000         1000 -        a0000
0001       100000 -      9e00000
0002      a000000 -      a200000
0003      a20e000 -     bc360000
0004     bdbff000 -     bf000000
0006    100000000 -    43f380000

The -memmap auto worked and returned a list containing a memory map same as above files:

'base': 4096, 'size': 651264, 'offset': 4096
'base': 1048576, 'size': 164626432, 'offset': 1048576
'base': 167772160, 'size': 2097152, 'offset': 167772160
'base': 169926656, 'size': 2987728896, 'offset': 169926656
'base': 3183472640, 'size': 20975616, 'offset': 3183472640
'base': 4294967296, 'size': 13945536512, 'offset': 4294967296

So the pysical range in the files are correct, but the format is unrecognized by memprocfs. Could you please take a look into that?

I'll try using the memmap auto option for now, and will report back if there's still any freezing issues.

from memprocfs.

I've fixed this issue now. The issue was that the ranges had to end with fff so your file above should have been something like

0x1000      0x9Ffff
0x100000    0x9DFFfff
...

This is not how it was documented and it's also quite cumbersome to adjust these manually so I made it accept both formats in the update. If you have installed via python pip you may have to upgrade the leechcorepyc package: pip install leechcorepyc --upgrade

Thanks for reporting this and please let me know if you should run into any additional issues or wish for more features. I'll release the scatter read update next week.

from memprocfs.