PCILeech is a direct memory access attack tool that reads and writes target system memory by leveraging PCIe hardware devices and DMA without requiring drivers on the target system.
PCILeech solves the problem of accessing physical memory on locked-down systems by exploiting the PCIe interface. It works through multiple acquisition methods: hardware-based approaches using USB3380 or FPGA devices that perform DMA over PCIe, and software-based methods including remote memory capture via DumpIt or WinPmem, local memory capture, and memory dump file formats. The tool can read memory at speeds exceeding 150MB/s. USB3380 hardware natively accesses up to 4GB of memory, while FPGA hardware and software methods can access all system memory. For systems with write access to memory, PCILeech can insert kernel implants that enable mounting live RAM and file systems as accessible drives, removing logon password requirements, loading unsigned drivers, executing code, and spawning system shells.
PCILeech targets security researchers and red team operators performing memory forensics and system compromise on x64 systems running UEFI, Linux, FreeBSD, or Windows. It suits scenarios where physical access to the target system or network access to a remote LeechService is available. The tool runs on Windows and Linux, with memory mounting capabilities also supported on macOS Sierra and earlier versions. A GUI frontend called PushPin exists to simplify common red team tasks, though it is maintained separately from the official distribution.
The project maintains active development with regular updates to both the core tool and its supporting LeechCore library. The codebase is written in C and distributed with precompiled binaries alongside source code. The tool supports an extensible architecture allowing users to create custom kernel shellcode and signatures for their specific targets.
