MEWDMA
Skip to content
Back to Learn

PCILeech, LeechCore and MemProcFS: the tools behind DMA software

What PCILeech, LeechCore and MemProcFS are, who makes them, how DMA software uses them, and why their names show up in your DMA error messages.
Post2h ago · phantom · 2 reads

PCILeech, LeechCore and MemProcFS are free, open-source tools made by a security researcher, Ulf Frisk. They were built to read a computer's memory over PCIe for security research and forensics. Most DMA software is built on top of them, which is why their names show up in your logs and error messages.

The four projects

All four live on Ulf Frisk's GitHub (ufrisk).

  • PCILeech.
    The original tool. It reads and writes a target computer's memory using DMA hardware.
  • PCILeech FPGA.
    The code that runs on FPGA DMA boards. It covers boards built on Xilinx Artix-7 chips, the same 35T, 75T and 100T family our GODLIKE 100T uses.
  • LeechCore.
    The library that talks to the card. It's the part that opens the USB connection and does the reading.
  • MemProcFS.
    The part that makes sense of what was read. It finds Windows' processes and memory layout, so software can find the game. Its core is called VMM.

How DMA software uses them

Your card's firmware gets the memory onto the USB cable. LeechCore picks it up on your second computer. MemProcFS works out where everything is. Then your DMA software reads the game's data and draws it. What DMA software does covers the last step.

That's why errors look the same across different software. If two programs both use MemProcFS, they'll both say "VMM INIT FAILED" for the same problem.

The messages you'll see

MessageComes fromWhat to read
[FAIL] VMM INIT FAILEDMemProcFSThe fix
Unable to load 'FTD3XX.dll' or 'leechcore_driver.dll'LeechCoreThe fix
Unable to locate valid DTBMemProcFSThe fix
Failed to retrieve Physical Memory Map!MemProcFSThe fix
[SYMBOL] Offline symbols unavailableMemProcFSThe fix
FPGA: ERROR: Unable to connect to USB/FT601 deviceLeechCoreThe fix

DMA error messages lists them all in one place.

What the speed numbers mean

The PCILeech FPGA project lists most USB boards at around 190 to 220 MB/s. That's the USB 3.0 link through the FT601 chip, and it's about what the GODLIKE 100T reaches too. How much of it you get depends on your firmware, your cable and your second computer's USB port. What a healthy speed test looks like.

Common questions

  • Do I need to download PCILeech myself?
    Usually not. Your DMA software comes with what it needs. If it says a file like FTD3XX.dll is missing, follow that fix.
  • Is MemProcFS a cheat?
    No. It's a memory analysis tool used in security and forensics. DMA software uses it as a building block.
  • What is the memory map I keep hearing about?
    A list of where your main PC's RAM really sits. MemProcFS normally works it out itself. DMA memory map.
  • Does any of this run on my main PC?
    No. It all runs on your second computer.

Stuck on an error? Open a ticket in our Discord with the full log, not just the last line.

Are we missing something?

Tell us what you came looking for and couldn't find, or what we got wrong, and we'll look into it. No account needed.

Did this help?

You don't need an account, this tells us what to write more of.