# PCILeech

Direct Memory Access (DMA) Attack Software

Repository: https://github.com/ufrisk/pcileech
Canonical: https://ross.abutalabs.com/products/pcileech
Language: C
License: AGPL-3.0
License Family: copyleft
Last push: 2026-07-25T20:12:35+00:00

## Health v2 (maintenance only)
Score: 65/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 94, release rhythm 8, longevity 100
- inputs: {"age_days": 3689, "days_push": 39, "days_rel": 594, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 7899, forks 1014 (observed 2026-08-28T04:10:08.988531+00:00)

## What it is
PCILeech is DMA attack software that uses PCIe hardware devices (or software memory acquisition methods) to read and write target system memory without requiring drivers on the target. It can insert kernel implants, access live RAM and file systems, remove logon password requirements, and spawn system shells on x64 UEFI, Linux, FreeBSD, and Windows targets.

## Use cases
- read target system memory over PCIe DMA without drivers
- dump live RAM from a Windows or Linux machine
- insert kernel implants to access the file system as a mounted drive
- bypass Windows logon password requirement
- acquire memory from remote systems via DumpIt or WinPmem
- analyze memory dump files for forensics
- perform red team physical access attacks with FPGA hardware

## When to choose
- you need driverless memory access to a target via PCIe hardware
- you're doing security research, forensics, or red team physical attacks
- you want to acquire live memory from Windows, Linux, FreeBSD, or UEFI x64 systems
- you need kernel-level access to a machine you have physical access to

## When to avoid
- you need a non-invasive or purely network-based security scanner
- you lack physical access or compatible PCIe hardware and no software acquisition method applies
- you're looking for a defensive-only monitoring tool
- your target systems are 32-bit or unsupported architectures

## Facets
- artifact type: application
- maturity: active
- function: security, penetration-testing, reverse-engineering, developer-tools, cli
- domain: security, penetration-testing, reverse-engineering, hardware, operating-systems
- platform: windows, cli, cpp
- tags: dma-attack, pcie, memory-acquisition, fpga, kernel-implants, forensics, red-team, linux

## Member repositories
- ufrisk/pcileech (main) score 65
- ufrisk/pcileech-fpga (infra) score 57

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:08.988531+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:33:25.993921+00:00, confidence not recorded.
  - readme: https://github.com/ufrisk/pcileech (fetched 2026-08-28T04:10:08.988531+00:00, sha f8f1d3437f46)
- Data as of 2026-08-30T08:39:29.467469+00:00.