HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
ufrisk
pcileech
C2016–2026
ufrisk / pcileech

pcileech

Direct Memory Access (DMA) Attack Software

Explore on GitHubRead Hacker News discussions
16Distinct people
18Mentions
0Explicit recommenders
8KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Direct Memory Access (DMA) Attack Software

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:28:18 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year18 dated mentions

Observed mentions: 2016-08-10 12:39:23 UTC to 2026-03-15 09:35:58 UTC.

0123452016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 2 mentions; 2 submissions, 0 comments20162017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC220
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC202
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC110
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC413
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC505
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC101
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC110
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

What Hacker News says

5 sources
bri3d·Nov 9, 2021
Yes, these cards are visible to the target's OS in their default configurations, as they appear in the PCIe configuration space at a minimum. While they can initiate DMA without the need for any OS-side drivers, an application with sufficient permissions can still locate them in the configuration tree. This is already part of the cat and mouse with game hackers, as they identify some of the standard PCIe VID/DIDs and at a second level, the PCIe configuration values for these cards. Beyond this, there are also a lot of ways using performance counters to see if memory is being accessed without the access being accounted for at the CPU level - https://github.com/ufrisk/pcileech/issues/107 has some documents around these approaches.
In A beginner’s guide to game hacking techniques [pdf]
jalk·Oct 25, 2021
The short description of PCILeech: [1] > PCILeech is capable of inserting a wide range of kernel > implants into the targeted kernels - allowing for easy > access to live ram and the file system via a "mounted > drive". It is also possible to remove the logon password > requirement, loading unsigned drivers, executing code and > spawn system shells. PCIleech runs on Windows and Linux [1] https://github.com/ufrisk/pcileech (edit for formatting)
In Modifying the Acorn CLE-215 FPGA into a PCILeech DMA Attack Device
Xeanort·Jan 17, 2021
* Unless you get an Evil Maid attack [0], like adding a physical keylogger to the keyboard bus. If the device is decrypted but on lock screen (like with TPM) there are more options, the main one is reading memory via DMA [1] on an ExpressCard slot (eg the wifi card). Also swapping out the memory to do a cold boot attack [2] is possible. [0] https://en.wikipedia.org/wiki/Evil_maid_attack [1] https://github.com/ufrisk/pcileech [2] https://en.wikipedia.org/wiki/Cold_boot_attack
In BitLocker Lockscreen Bypass

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.