NeTV2: ERROR: Unable to retrieve required Device PCIe ID about pcileech-fpga

[ufrisk]

@ConnorMAD
That is a very old version of pcileech indeed. From what I can see it's before NeTV2 support was added.

I cannot support very old versions like the one you linked to. You'd have to ask the creator of that project to update or give it a try yourself.

Since that project is used for game hacking I cannot take on this work myself. I prefer not to get involved. But I wish you the best in your endeavors.

A good thing for you might be to try it with the most recent PCILeech to see if you can get simple read to work (aka pcileech.exe display) command.

[ufrisk]

The NeTV2 is correctly flashed and PCILeech is able to communicate with it properly.

The 0000 in [5,v4.2,0000] indicates that there is a problem with the PCIe connection. I know others have had problems with this on other systems as well; I haven't been able to pinpoint why yet since I don't really have a good test system myself to test against and I haven't been too keen on purchasing a new computer for a lot of money to test on.

Most systems so far that reported issues are newer AMD gaming PC's; some people have reported success by changing the PCIe slot; other people have reported success by underclocking the memory (but I fail to see why this should make a difference, but it's been reported).

There are some people talking about it in this issue: #46

What kind of system do you have?

[nazarihome]

My motherboard is msi Z170A GAMING and my processor is Intel core i-7, overclocking is off. I switched to another target computer(A Dell X-64 server) and it doesn't give me the error anymore.

[ufrisk]

can you please retry-this with the v4.4 bitstream released just today? does it resolve this issue?

[ConnorMAD]

FPGA: ERROR: Unable to retrieve required Device PCIe ID [0,v0.0,0000]
can you help me @ufrisk

[ufrisk]

@ConnorMAD there is an error with the connection to the FPGA. Either you have no network connection to it (firewall, wrong ip address?) or there is an issue with the flash.

Can you ping the NeTV2 device? How does your pcileech command line look like?

[ConnorMAD]

@ufrisk I think I'm trying to compile a non-updated version of pcileech.
I'm studying the project https://github.com/EngineOwningSoftware/pcileech-webradar, but I've tried updating it to the current pcileech files, but it doesn't recognize my FPGA.

[ConnorMAD]

thank you anyway @ufrisk

[ConnorMAD]

is there any wiki showing how i can deliver pcileech in my program? to open it on the second pc? @ufrisk

[ConnorMAD]

I made a mini 2d radar project with websocket, but I don't know how to start integrating with pcilech

[ufrisk]

@ConnorMAD If you wish to program against PCILeech there are documentation either in the form of header files (C/C++), docs.rs (Rust), MemProcFS project Wiki (Python), JavaDoc (Java) or Examples (C/C++, C#, Python and Rust).

Also if you're more interested in games (which I'm not really) there are other projects floating around out there that use my tools.

I'm not up for providing extensive help, sorry :\ Also I'm staying away from games and focusing more in the forensic aspects of my project.

[ConnorMAD]

I have no intention of continuing with games, I'm just learning.
I thought games would be a good start.

[ufrisk]

No worries, yeah, it's probably a good place to start. It's just that I'm not really able to help with that. But there should be code floating around doing that. Also check out the memprocfs examples: https://github.com/ufrisk/MemProcFS/tree/master/vmm_example

Best wishes with everything!

[ConnorMAD]

@ufrisk Sorry for the ignorance, But would I read the memory without using a DMA?

[ufrisk]

@ConnorMAD alternative ways are to use a driver to dump the memory. Examples are DumpIt or WinPMEM.

Also, if you're running inside a VM such as Hyper-V, VMWare or QEMU you may also access memory from the host os.

[ConnorMAD]

@ufrisk is there any method of using this over long distance?

[ufrisk]

There is a LeechAgent and "MemProcFS remoting" which you could use. It's not built for this use case but it should work if you add the FTD3XX.dll to the folder of the LeechAgent. You would then connect over the network to the Agent which could then in turn connect to the memory via whatever method you wish, (driver or pcie dma hardware).

It's primarily focused on AD environments, but it should be possible to run it in non-ad environments as well. There is also an "insecure" more with no authentication at all (dangerous if not properly firewalled).

https://github.com/ufrisk/MemProcFS/wiki/_Remoting

[ConnorMAD]

There is a LeechAgent and "MemProcFS remoting" which you could use. It's not built for this use case but it should work if you add the FTD3XX.dll to the folder of the LeechAgent. You would then connect over the network to the Agent which could then in turn connect to the memory via whatever method you wish, (driver or pcie dma hardware).

It's primarily focused on AD environments, but it should be possible to run it in non-ad environments as well. There is also an "insecure" more with no authentication at all (dangerous if not properly firewalled).

https://github.com/ufrisk/MemProcFS/wiki/_Remoting

Another thing, @ufrisk I was able to connect to vmware and get the memory of the vm, but how could I do the opposite? Using the vm to get memory from the main computer?

[ufrisk]

That is not possible unless you use something like the agent I was mentioning over the network between host/vm.

[ConnorMAD]

I read the guide about leechcore and leechagent, I thought it was great, but I have a question, is there a way to do this locally? using two local computers?

[ConnorMAD]

-remote localhost?
or use ipv4 address for connection?

[ufrisk]

You'd need to specify the IP-address / host-name of the other computer. If you specify localhost it will be trying to connect to the same computer not the 2nd one.

[ConnorMAD]

@ufrisk Sorry for the ignorance I would have to put for example setspn -S ipv4adress mycomputername?

[ufrisk]

easiest would probably be if you start the agent in insecure interactive mode. from a command prompt: leechagent.exe -interactive -insecure

and then connect to it with pcileech.exe display -min 0x1000 -device fpga -remote rpc://insecure:<your_remote_ip>

ensure the firewall on the system with the agent is off or allows incoming connections to tcp/28473 (if I remember correctly).

[ConnorMAD]

thanks, connection, but this show me:
DEVICE: ERROR: unable to locate the winpmem driver file ''.

[ConnorMAD]

Thank you, I will be a sponsor in your project. I'm learning many things

[ufrisk]

You'd have to run the agent in elevated adminidtrator mode.

You'd have to run it from C:

The winpmem_x64.sys must be in the same folder as leechagent.exe

Please let me know how it goes :)

[ConnorMAD]

Failed: RPC: RpcServerUseProtseqEpA (0x000006cc).

what is this error?
it was working normally, but I had to change computers and it didn't work again.
port 28473 is open TCP

[ConnorMAD]

@ufrisk Can you help me with the above error?