Device_FPGA

Memory Acquisition Method: FPGA (Hardware)

The LeechCore library supports reading memory using PCILeech FPGA PCIe to USB hardware.

Facts in short:

• Is supported on all supported platforms.
• Acquires memory in read/write mode.
• Acquired memory is assumed to be volatile.
• Have additional requirements.

If having issues with DMA not working fully on AMD or Thunderbolt please check out DMA on AMD and Thunderbolt.

---

Connection string:

LeechCore API:

Please specify the acquisition device type (and optionally additional configuration options) LEECHCORE_CONFIG.szDevice when calling LeechCore_Open. Most configuration options should ideally never be used and only exists for debugging purposes. Examples: FPGA FPGA://pciegen=1,tmread=500,tmwrite=200,devindex=2.

Options:

• ft2232h=1 Use FT2232H and FTD2XX.DLL for USB2 connection (instead of default FT601/FTD3XX.DLL).

• ft601=1 Use FT601 and FTD3XX.DLL/FTD3XXWU.DLL FT601 USB3 connectivity. This parameter is useful when another device, such as a ZDMA, exists in the same system.

• pciegen= PCIe generation - 2 (default) or 1 (PCIe gen1).

• pcienotconnected= PCIe connection requirement: 0 = PCIe connection required (default); 1 = PCIe connection not required.

• devindex= device index to open (if multiple devices exist on system).
  The devindex parameter is only supported on Windows. It's ignored on Linux.

• devreload= Reload bitstream / restart device: 0 = no reload (default); 1 = reload.
  May sometimes unfreeze the device on AC701/ScreamerM2 devices on v4.6+ bitstreams.

• readsize= max chunk read size in bytes, multiple of page (default depends on FPGA device).

• readretry= number of read retries on read fail.

• tmread= Read delay in uS (default depends on FPGA device); applies to old algorithm only.

• tmwrite= Write delay in uS (default depends on FPGA device).

• tmprobe= Probe delay in uS (default depends on FPGA device).

• bdf= Override device id. Example: bdf=0x0400 sets device id to 04:00.0 regardless of actual device id.

• ats= Override PCIe TLP AT field. 0 = Untranslated/Default, 2 = Translated (ats=2).

• algo= read algorithm as per below.

#	algorithm description
0	async normal read (default)
1	async tiny read
2	old normal read
3	old tiny read
4	old async read

Please note that the async algorithm is only available on Windows; Linux will fallback to the synchronous "old" algorithm automatically.

PCILeech / MemProcFS:

Please specify the device type in the -device option.

Examples:

-device FPGA

-device FPGA://devreload=1,algo=1

-device FPGA://pciegen=1,algo=2,tmread=300,tmwrite=300,tmprobe=300

---

Requirements:

Requires the FPGA hardware which is connected to the target computer over PCIe and to the analysis computer over USB.

Windows:

FTDI drivers have to be installed if FPGA is used on Windows.

Download the 64-bit FTD3XX.dll from FTDI and place it alongside leechcore.dll. Often the kernel driver is installed automatically, but if they are not download the FT601 Kernel Driver as well.

If using the FT2232H instead of the FT601 please download D2XX drivers from ftdichip.

Linux:

Requires the driver leechcore_ft601_driver_linux from the LeechCore-plugins project. Place leechcore_ft601_driver_linux.so alongside leechcore.so. This driver is pre-packaged together with the binary release distribution of LeechCore. Also requires libusb (apt-get install libusb-1.0-0) and access to the usb device (permission change or run as root may be required).

If using the FT2232H instead of the FT601 please download D2XX drivers from ftdichip.

macOS:

Requires the driver leechcore_ft601_driver_macos from the LeechCore-plugins project. Place leechcore_ft601_driver_macos.dylib alongside leechcore.dylib as well as the driver libftd3xx.dylib from ftdichip.com. This driver is pre-packaged together with the binary release distribution of LeechCore.

⚠️ ZDMA thunderbolt devices are not supported on macOS.