ufrisk/pcileech

Features

• Acquisition and Imaging - Implements hardware-based DMA acquisition to capture volatile memory by bypassing operating system security controls.
• DMA Attack Frameworks - Provides a toolkit for reading and writing remote system memory via PCIe Direct Memory Access to bypass security.
• Memory Analysis - Runs analysis scripts on a remote host to inspect memory without requiring full data dumps.
• PCIe Device Emulation - Uses programmable hardware to mimic a legitimate PCIe device to gain unauthorized access to the target system bus.
• Kernel Exploitation - Executes shellcode or implants and patches system memory signatures to bypass security requirements.
• Live Forensics - Maps volatile memory or file systems as local drives to explore data without installing software on the target.
• Direct Memory Access - Provides capabilities for reading and writing raw physical memory addresses to bypass OS-level protections.
• DMA Memory Acquisition - Reads and writes physical system memory by bypassing the CPU and operating system via a hardware PCIe interface.
• Remote Physical Memory Reading - Enables reading data from a remote system's memory via direct hardware access without target-side software.
• Remote Physical Memory Writing - Enables writing data to a remote system via direct memory access without requiring local drivers on the target.
• PCIe Bus Traffic Analysis - Captures and displays raw transaction layer packets directly from the PCIe bus using compatible hardware.
• Hardware Memory Acquisition Tools - Captures volatile RAM from a target machine using specialized hardware interfaces and PCIe firmware.
• Kernel-Level Code Execution - Enables running implants or shellcode on a target system to spawn shells and execute binaries.
• Memory Forensics - Mounts live RAM as local drives and analyzes remote memory without needing full data dumps.
• Remote Memory Manipulation - Provides the ability to modify remote system memory to insert implants and change system state without target drivers.
• Kernel-Level Bypass Utilities - Modifies system memory signatures and executes shellcode in the kernel to bypass security checks.
• Data Acquisition - Extracts data from live sessions or crash files using hardware or software agents for volatile data analysis.
• Volatile Memory Mapping Systems - Maps volatile memory as local drives to allow direct data exploration and forensic analysis.
• PCIe Transaction Layer Capture - Intercepts and analyzes raw PCIe bus traffic by capturing packets at the hardware link layer.
• Hardware Communication Bridges - Loads custom low-level code onto development boards to establish the communication bridge between the host and target.
• Bus Tracing - Captures and displays raw transaction layer packets directly from the PCIe bus using compatible hardware.
• Remote Memory Filesystems - Maps remote physical memory addresses to local virtual memory for real-time exploration as a mounted filesystem.
• Hardware-Based - Captures raw transaction layer packets and analyzes memory on a remote host using compatible PCIe development boards.
• Runtime Memory Patching - Modifies memory signatures in running processes to unlock features or bypass security requirements.
• Hardware Security - Software for performing Direct Memory Access attacks.
• Physical Access Tools - Reads and writes system memory via DMA over PCIe hardware.
• Physical Security - PCI-based DMA attack tool.

Star-Verlauf