Hiding the existence of a PCIe device from the operating system

[si_blakely]

@MaverocK

We tested with my friends by setting the device and vendor ID as 0xFFFF. The device literally won’t appear to the OS. The device manager won’t show it. SIV (System Information Viewer http://rh-software.com/) also won’t show it.

Was the PCI device then able to access system memory in a transparent manner via DMA?

Inquiring minds want to know …

[MaverocK]

@si_blakely

Was the PCI device then able to access system memory in a transparent manner via DMA?

Inquiring minds want to know …

Yes, it did!

The PCI Express specification says that a device is allowed to issue memory or I/O requests only when the “Bus Master Enable” configuration bit has been set. This bit is usually set by the driver, but your device could simply ignore it (the pcileech device obviously does this).

Source: fpga - Can a non-enumerated device conduct DMA operations? - Electrical Engineering Stack Exchange

[false]

@MaverocK

Yes, it did!

Sorry to bring that up after these months, we are a small group of students working on a security project and willing to achieve the same bahiviour (hide the device from the OS) based on pci leech.
By modifying the device and vendor IDs to 1’s the device seems to not be detected by the OS, but we only get the pci leech probe function to work ; We get errors as soon as we try to read memory. The problem doesn’t appear with standart vid/device id.
Did you change anything else in the IP Core to be able to read memory?

[MaverocK]

@false

Sorry to bring that up after these months, we are a small group of students working on a security project and willing to achieve the same bahiviour (hide the device from the OS) based on pci leech.
By modifying the device and vendor IDs to 1’s the device seems to not be detected by the OS, but we only get the pci leech probe function to work ; We get errors as soon as we try to read memory. The problem doesn’t appear with standart vid/device id.
Did you change anything else in the IP Core to be able to read memory?

I was only able to read when the system has max 4 GB of memory (probably to the 32bit vs 64bit thing) . Try installing it the OS on a 4 GB stick and try reading it that way. It might work. Ulf Frisk (the author of pcileech project) says he was able to read while vendor and device ID was 0xFFFF: Cannot read memory when device and vendor ID set as 0xFFFF · Issue #8 · ufrisk/LeechCore · GitHub