PCILeech is a security research and memory acquisition tool that provides access to physical memory using Direct Memory Access (DMA) over PCIe and other supported acquisition methods.
The software can communicate with compatible FPGA-based hardware to read memory without requiring software to run on the target computer. It also supports software-based acquisition through the LeechCore library, including memory dump files and selected live memory sources.
PCILeech is intended for specialist activities such as digital forensic investigations, incident response, hardware security assessments and penetration testing. Its capabilities extend beyond memory acquisition to memory modification and low-level security research.
Hardware compatibility and target system protections are important considerations. Modern IOMMU implementations, DMA remapping and other security mechanisms can restrict access to protected memory regions.
This is free and open source software.
Key Features
- Acquires physical memory through supported PCIe DMA hardware.
- Works with FPGA-based devices and USB3380 hardware.
- Supports additional software-based memory acquisition sources through LeechCore.
- Provides access to raw physical memory dumps and selected virtual machine memory sources.
- Supports local and remote acquisition workflows.
- Offers raw PCIe Transaction Layer Packet access with compatible FPGA hardware.
- Provides memory read and write capabilities where supported by the target and acquisition method.
- Supports specialist kernel and memory security research.
- Cross-platform support – runs on Linux and Windows.
Website: github.com/ufrisk/pcileech
Support:
Developer: Ulf Frisk
License: GNU Affero General Public License v3.0
PCILeech is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Forensics Memory Tools | |
|---|---|
| MemProcFS | View physical memory as files in a virtual file system |
| pypykatz | Python implementation of Mimikatz |
| PCILeech | Security research and memory acquisition tool |
| Volatility | Advanced memory forensics framework |
| AVML | Acquire Volatile Memory for Linux |
| Volshell | CLI tool for working with memory |
| LeechCore | Physical memory acquisition library |
| EVTXtract | Recovers and reconstructs fragments of EVTX log files |
| mquire | Memory forensics and analysis tool |
| LEMON | Memory acquisition utility |
| yarp | Yet Another Registry Parser |
| emd | Command line memory acquisition tool for Linux systems |
| AutoTimeliner | Extract forensic timeline from volatile memory dump |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.