Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bug] MemProcFS suddenly fails to initialize on AMD system + Thunderbolt - BAD DTB PID 4, unable to locate ntoskrnl.exe #3, FPGA read failures

Open
  • Is something wrong?
#425 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
c
Domain
operating-systems

Research direction

No source files or tests are named. Start by reproducing the reported command with the supplied physical-memory map and compare the initialization logs with PCILeech's raw-read results. Done means identifying why OS initialization fails on this setup and verifying that MemProcFS initializes successfully.

Written by the indexing model from the issue text.

Description

The target Windows PC continued operating normally, with same setup for 2 months. Yesterday I noticed that my DMA reads had stopped working. I then opened my DMA benchmarking/testing application and encountered initialization errors.

[PROCESS] BAD DTB: PID=4 DTB=00000000001b3000
[CORE] Initialization Failed. Unable to locate ntoskrnl.exe. #3
[CORE] Unable to auto-identify operating system.
[CORE] Failed to initialize.

Persists after reflashing the FPGA firmware, performing complete power cycles, restarting both computers, changing FPGA read algorithms, and supplying a manually generated physical-memory map.

Target PC
Platform: AMD CPU/chipset, ASUS motherboard
RAM: 32GB
Operating system: Windows 11 Pro
Current Windows version: 10.0.26300.9457
Virtualization-based security (VBS): Enabled and Disabled
IOMMU: Off

Thunderbolt information
Thunderbolt Control Center reported:

Controller: Thunderbolt(TM) Controller - 1137
Connected Device: ASMedia 246x
Connection Status: Connected
PCIe Tunneling: Enabled
Security Level: SL0 (No Security)
NVM Firmware: 43.3

Windows reported:

Status: OK
FriendlyName: Thunderbolt(TM) Controller - 1137
Service: nhi
ProblemCode: 0
DriverVersion: 1.41.1340.0
DriverDate: 2022-09-14

2nd PC

MemProcFS / VMM: 5.19.0.251
LeechCore: 2.23.4.104
PCILeech: 4.20
FPGA firmware: v4.14,2400 (default pcileech)

Reproduction steps

From the acquisition PC:

cd /d "C:\Users\user\Desktop\MemProcFS"
memprocfs.exe -device fpga -memmap auto

This was my original working command.

After reading the official LeechCore AMD/Thunderbolt guide, I replaced automatic physical-memory discovery with a manually supplied map:

cd /d "C:\Users\user\Desktop\MemProcFS"
memprocfs.exe -device fpga -memmap "physmemmap.txt" -v -vv

MemProcFS recognizes the FPGA and loads the memory-map entries, but fails during OS initialization.

DEVICE: FPGA: Enigma X1 PCIe gen1 x1 [300,25,500] [v4.14,2400] [ASYNC,NORM]

[CORE] DTB located at: 00000000001b3000. MemoryModel: X64
[PROCESS] BAD DTB: PID=4 DTB=00000000001b3000
[CORE] Initialization Failed. Unable to locate ntoskrnl.exe. #3
[CORE] Unable to auto-identify operating system.
       Specify PageDirectoryBase (DTB/CR3) in -dtb option if value if known.

[CORE] Failed to initialize.

The same problem occurs when changing the FPGA algorithm:

memprocfs.exe -device "fpga://algo=1" -memmap "physmemmap.txt" -v

The supplied physmemmap.txt contains:

0x1000       0xA0000
0x100000     0x9D1F000
0xA000000    0xA200000
0xA20E000    0xB000000
0xB020000    0xB983C000
0xBB9FF000   0xBD000000
0x100000000  0x83F380000

MemProcFS / LeechCore appears to accept and load all seven entries:

LcMemMap_AddRange: 0000000000001000-000000000009ffff -> 0000000000001000
LcMemMap_AddRange: 0000000000100000-0000000009d1efff -> 0000000000100000
LcMemMap_AddRange: 000000000a000000-000000000a1fffff -> 000000000a000000
LcMemMap_AddRange: 000000000a20e000-000000000affffff -> 000000000a20e000
LcMemMap_AddRange: 000000000b020000-00000000b983bfff -> 000000000b020000
LcMemMap_AddRange: 00000000bb9ff000-00000000bcffffff -> 00000000bb9ff000
LcMemMap_AddRange: 0000000100000000-000000083f37ffff -> 0000000100000000

Using the manual map does not resolve the failure.

Although MemProcFS fails to initialize, PCILeech can communicate with the FPGA and read some physical memory.

PCILeech 4.20's built-in benchmark completed and reported:

READ   8 B       4846 reads/s     37 kB/s
READ 128 B       4277 reads/s    534 kB/s
READ 512 B       3119 reads/s   1559 kB/s
READ   4 kB      3642 reads/s     14 MB/s
READ  64 kB      1130 reads/s     70 MB/s
READ   1 MB       142 reads/s    142 MB/s
READ  16 MB         9 reads/s    144 MB/s

I have tried:

  • Restarting both PCs.
  • Fully shutting down and power-cycling the target PC.
  • Removing power and discharging residual power.
  • Separately power-cycling the independently powered Thunderbolt enclosure/riser.
  • Reseating the FPGA.
  • Reflashing the default Enigma X1 firmware.
  • Running with PCIe Gen1 instead of Gen2.
  • Replacing/checking MemProcFS and LeechCore DLLs.
  • Testing PCILeech raw physical memory reads.
  • Running PCILeech's built-in benchmark.
  • Testing -memmap auto.
  • Testing a manually supplied physical-memory map.
  • Testing FPGA algorithm 0.
  • Testing FPGA algorithm 1.
Dominant language
C
Stars
4.4k
Forks
523
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ufrisk/MemProcFS

All issues in ufrisk/MemProcFS

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.