# Hiding the existence of a PCIe device from the operating system **URL:** \ **Category:** Factual Questions\ **Created:** [October 16, 2019, 3:54pm UTC](https://boards.straightdope.com/t/hiding-the-existence-of-a-pcie-device-from-the-operating-system/841849 "2019-10-16T15:54:36Z")\ **Posts on this page:** 4\ **Page:** 2
**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\ **Post date:** [November 17, 2019, 8:06pm UTC](https://boards.straightdope.com/t/hiding-the-existence-of-a-pcie-device-from-the-operating-system/841849/21 "2019-11-17T20:06:49Z")
> [@MaverocK](#): > > We tested with my friends by setting the device and vendor ID as 0xFFFF. The device literally won’t appear to the OS. The device manager won’t show it. SIV (System Information Viewer [http://rh-software.com/](http://rh-software.com/)) also won’t show it. Was the PCI device then able to access system memory in a transparent manner via DMA? _Inquiring minds want to know_ … 😃 ---
**Author:** ![MaverocK](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@MaverocK](https://boards.straightdope.com/u/MaverocK)\ **Post date:** [November 19, 2019, 3:19am UTC](https://boards.straightdope.com/t/hiding-the-existence-of-a-pcie-device-from-the-operating-system/841849/22 "2019-11-19T03:19:13Z")
> [@si\_blakely](#): > > Was the PCI device then able to access system memory in a transparent manner via DMA? > > _Inquiring minds want to know_ … 😃 Yes, it did! > [@](#): > > The PCI Express specification says that a device is allowed to issue memory or I/O requests only when the “Bus Master Enable” configuration bit has been set. This bit is usually set by the driver, but your device could simply ignore it (the pcileech device obviously does this). Source: [fpga - Can a non-enumerated device conduct DMA operations? - Electrical Engineering Stack Exchange](https://electronics.stackexchange.com/questions/466240/can-a-non-enumerated-device-conduct-dma-operations) ---
**Author:** ![false](https://avatars.discourse-cdn.com/v4/letter/f/ac8455/32.png) [@false](https://boards.straightdope.com/u/false)\ **Post date:** [February 22, 2020, 5:46pm UTC](https://boards.straightdope.com/t/hiding-the-existence-of-a-pcie-device-from-the-operating-system/841849/23 "2020-02-22T17:46:22Z")
> [@MaverocK](#): > > Yes, it did! Sorry to bring that up after these months, we are a small group of students working on a security project and willing to achieve the same bahiviour (hide the device from the OS) based on pci leech. By modifying the device and vendor IDs to 1’s the device seems to not be detected by the OS, but we only get the pci leech probe function to work ; We get errors as soon as we try to read memory. The problem doesn’t appear with standart vid/device id. Did you change anything else in the IP Core to be able to read memory? ---
**Author:** ![MaverocK](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@MaverocK](https://boards.straightdope.com/u/MaverocK)\ **Post date:** [February 25, 2020, 6:06pm UTC](https://boards.straightdope.com/t/hiding-the-existence-of-a-pcie-device-from-the-operating-system/841849/24 "2020-02-25T18:06:06Z")
> [@false](#): > > Sorry to bring that up after these months, we are a small group of students working on a security project and willing to achieve the same bahiviour (hide the device from the OS) based on pci leech. > By modifying the device and vendor IDs to 1’s the device seems to not be detected by the OS, but we only get the pci leech probe function to work ; We get errors as soon as we try to read memory. The problem doesn’t appear with standart vid/device id. > Did you change anything else in the IP Core to be able to read memory? I was only able to read when the system has max 4 GB of memory (probably to the 32bit vs 64bit thing) . Try installing it the OS on a 4 GB stick and try reading it that way. It might work. Ulf Frisk (the author of pcileech project) says he was able to read while vendor and device ID was 0xFFFF: [Cannot read memory when device and vendor ID set as 0xFFFF · Issue #8 · ufrisk/LeechCore · GitHub](https://github.com/ufrisk/LeechCore/issues/8) [Previous page](https://boards.straightdope.com/t/hiding-the-existence-of-a-pcie-device-from-the-operating-system/841849.md?page=1)