Skip to content

Windows DTB & AMD plaftorm #13

Description

@colo808

memflow-pcileech and memflow-win32

There is a problem with reading Windows DTB from lowstub
on AMD platform B650 chipset I'm unable to read lowest range 0x1000 due unknown reason

2025-06-03T18:44:04.086Z WARN [memflow::error] oslayer: not found (unable to find x64 dtb in lowstub < 1M)
2025-06-03T18:44:04.086Z WARN [memflow_win32::kernel::start_block] x64::find_lowstub() error: oslayer: not found
2025-06-03T18:44:04.251Z WARN [memflow::error] oslayer: not found (unable to find x64 dtb in lowstub < 16M)
2025-06-03T18:44:04.412Z WARN [memflow::error] oslayer: not found (unable to find x86_pae dtb in lowstub < 16M)
2025-06-03T18:44:04.570Z WARN [memflow::error] oslayer: not found (unable to find x86 dtb in lowstub < 16M)
2025-06-03T18:44:04.738Z WARN [memflow::error] oslayer: not found (unable to find aarch64 dtb in lowstub < 16M)
2025-06-03T18:44:04.738Z ERROR [memflow::error] oslayer: not found (unable to find dtb)
2025-06-03T18:44:04.738Z ERROR [memflow::plugins::util] oslayer: not found

If I skip the lowest range I don't get the errors as above, however with skipping, the dtb is not found and I can't find processes in OS
IOMMU/PreBootProtection disabled
It worked fine on Intel platform and it's weird that that regions is somehow protected despite iommu disabled.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions