This program is used to control an FPGA board running the PCILeech firmware. DMAReaper will automatically seek and destroy the DMAR ACPI table on the target computer via pre-boot DMA attack against UEFI. When successful, this operation will prevent usage of the IOMMU and subsequent initialization of Kernel DMA Protection when Windows Boots. This program is suitable for disabling Kernel DMA Protection on windows 10 or windows 11 even when target firmware has Secure Boot, VT-d, VT-x, Sure Start, Virtualization based BIOS Security, and Enhanced firmware runtime intrusion detection and prevention Enabled. This method will not trigger BitLocker recovery on auto-booting Windows with TPM BitLocker key protector. If you require disabling pre-boot DMA protection in order to use this tool but do not have access to UEFI GUI, consider patching settings in firmware directly with the help of NVRAMap.
usage: DMAReaper.py [-h] [-v] [-i INTENSITY] [-min MIN_ADDR] [-max MAX_ADDR]
DMAReaper — Disable Kernel DMA Protection via DMAR overwrite
options:
-h, --help show this help message and exit
-v, --verbose Enable verbose debug output
-i INTENSITY, --intensity INTENSITY
Number of times each memory segment is read during scan. Lower is faster but less reliable. (default: 3)
-min MIN_ADDR, --min-addr MIN_ADDR
Minimum scan address (default: 0x10000000)
-max MAX_ADDR, --max-addr MAX_ADDR
Maximum scan address (default: 0xFFFFFFFF)
The only value you might need to change out of the box is MIN_ADDR.
- Connect the FPGA board to the target computer via appropriate PCI Express port (M.2 / ExpressCard / Mini PCIe)
- Connect the FPGA board to the attack computer via the data port (USB-C)
- Power on the target computer
- Quickly power on the board to ensure proper initialization
- Enter UEFI on the target computer
- You may need to repeat steps 3-5 several times before you get a valid PCIe Link. Timing is key.
- Once valid PCIe Link is established, run the DMAReaper.py program from attack computer and wait for success message.
- Upon completion, select "Continue Boot" or equivalent on target computer to boot into Windows with Kernel DMA Protection disabled.
For more info, read my detailed blog post.
This program uses the LeechCore python API to control the FPGA and scan memory of target computer during UEFI. DMAReaper will identify the EFI System Table, use it to find the Configuration table and isolate the ACPI 2.0 VendorTable pointer. The program will then identify the ACPI 2.0 Root System Description Table to find all installed ACPI tables and parse them to identify the DMAR ACPI entry. Once the DMAR ACPI table is located, it will be overwritten with null bytes, effectively destroying it. Windows uses the DMAR table to report the IOMMU remapping, and when the table is absent, cannot utilize kernel DMA protection features. As a result, the protection is disabled and windows will boot without it. Note that this does not impact Virtualization Based Security (VBS) features such as HVCI and Secure System.
A special thank you goes out to Ulf Frisk, the creator of the amazing PCILeech framework and LeechCore Library.