Register for your free account! | Forgot your password?

Go Back   elitepvpers > Popular Games > Valorant
You last visited: Today at 08:40

  • Please register to post and access all features, it's quick, easy and FREE!

Advertisement



VGK-DMA-BYPASS

Discussion on VGK-DMA-BYPASS within the Valorant forum part of the Popular Games category.

Reply
 
Old   #1
 
elite*gold: 9
Join Date: Dec 2023
Posts: 2
Received Thanks: 0
VGK-DMA-BYPASS

The article below is written by my good friend AceKingSuited. He’s an awesome developer.
Cheers for AceKingSuited!


-----------------------------------------
Thanks to my friend kilmu1337。I will show you how to make your firmware "active"

Overall, firmware with proper interrupts fired can surely pass vgk"

What is an active device?


An "active device" is actually a misnomer used by firmware developers. Instead of saying a device is "active," it's more accurate to say that the device frequently initiates DMA (Direct Memory Access) transfers. After a DMA transfer is completed, an interrupt is used to notify the CPU that the data has been successfully transferred. This mechanism is often referred to as the "doorbell" mechanism, which is a very apt analogy—just like a delivery person ringing the doorbell to notify you that your package has arrived, the device "rings the doorbell" to inform the CPU that the data is ready.

In a normal operation, if a device initiates a DMA transfer, there will be an interrupt to notify the CPU. In PCIe (Peripheral Component Interconnect Express), interrupts are typically implemented in three ways: Legacy Interrupt, MSI (Message Signaled Interrupt), and MSI-X (Message Signaled Interrupt Extended).
  • Legacy Interrupt is the traditional method used by PCI devices to send interrupts.
  • MSI and MSI-X are more commonly used in PCIe devices.

Once MSI or MSI-X is enabled in the PCIe device's configuration space (CFG space), the device will use MSI or MSI-X to send interrupts to the CPU.

How to make your firmware "active"


The way to make your firmware "active" is by using the cfg interrupt interface provided in the Xilinx PCIe IP core to send interrupts to the Root Complex (RC). The code example is as follows:

Code:
    assign ctx.cfg_interrupt_di             = cfg_int_di;
    assign ctx.cfg_pciecap_interrupt_msgnum = cfg_msg_num;
    assign ctx.cfg_interrupt_assert         = cfg_int_assert;
    assign ctx.cfg_interrupt                = cfg_int_valid;
    assign ctx.cfg_interrupt_stat           = cfg_int_stat;
always @ ( posedge clk_pcie ) begin
   if ( rst ) begin
       cfg_int_valid <= 1'b0;
       cfg_msg_num <= 5'b0;
       cfg_int_assert <= 1'b0;
       cfg_int_di <= 8'b0;
       cfg_int_stat <= 1'b0;
   end else if (cfg_int_ready && cfg_int_valid) begin
       cfg_int_valid <= 1'b0;
   end else if (o_int) begin
       cfg_int_valid <= 1'b0;
   end
end
time int_cnt = 0;
always @ ( posedge clk_pcie ) begin
   if (rst) begin
       int_cnt <= 0;
   end else if (int_cnt == 32'd100000) begin
       int_cnt <= 0;
   end else if (int_enable) begin
       int_cnt <= int_cnt + 1;
   end
end

assign o_int = (int_cnt == 32'd100000);
This method is widely used, but it has a critical drawback: when the emulated device has an MSI-X capability (MSI-X CAP), this method cannot transmit interrupts. The reason is that the interrupt interface in the Xilinx IP core does not support sending MSI-X type interrupts. Therefore, when the emulated device has an MSI-X CAP, you need to manually construct a TLP (Transaction Layer Packet) to send an interrupt signal to the Root Complex (RC). According to PCIe documentation, an interrupt is essentially a MEMWR64 type TLP packet sent to the RC. The code for manually constructing and sending this packet is as follows:


Code:
        bit msix_valid;
        bit msix_has_data;
        bit[127:0] msix_tlp;
        assign tlps_static.tdata[127:0] = msix_tlp; 
        assign tlps_static.tkeepdw  = 4'hf;
        assign tlps_static.tlast   = 1'b1;
        assign tlps_static.tuser[0] = 1'b1;
        assign tlps_static.tvalid   = msix_valid;
        assign tlps_static.has_data   = msix_has_data;
        wire      [31:0] HDR_MEMWR64 = 32'b01000000_00000000_00000000_00000001;
        wire       [31:0] MWR64_DW2  = {`_bs16(pcie_id), 8'b00000000, 8'b00001111};
        wire       [31:0] MWR64_DW3  = {i_addr[31:2], 2'b0};
        wire       [31:0] MWR64_DW4  = {i_data};

    always @ ( posedge clk_pcie ) begin
        if ( rst ) begin
            msix_valid <= 1'b0;
            msix_has_data <= 1'b0;
            msix_tlp <= 127'b0;
        end else if (msix_valid) begin
            msix_valid <= 1'b0;
        end else if (msix_has_data && tlps_static.tready) begin
            msix_valid <= 1'b1;
            msix_has_data <= 1'b0;
        end else if (o_int) begin
           // msix_valid <= 1'b1;
            msix_has_data <= 1'b1;
            msix_tlp <= {MWR64_DW4, MWR64_DW3, MWR64_DW2,HDR_MEMWR64};
        end
    end
    time int_cnt = 0;
    always @ ( posedge clk_pcie ) begin
        if (rst) begin
            int_cnt <= 0;
        end else if (int_cnt == 32'd100000) begin
            int_cnt <= 0;
        end else if (int_enable) begin
            int_cnt <= int_cnt + 1;
        end
    end
    assign o_int = (int_cnt == 32'd100000);
The complete code will be released on pcileech_pcie_cfg_a7.sv on github: kilmu1337.

=======
maybe sm ppl has read this article, i post this on elitepvpers again though XDDDD
kilmu1337 is offline  
Reply

Tags
dma, firmware, kilmu, vgk


Similar Threads Similar Threads
[Selling] 😈 1:1 DMA Firmware Emulation 😈 EAC/BE/VGK⚡6 Month Warranty⚡Never Detected ⚡ DMA
11/24/2025 - Fortnite Trading - 4 Replies
https://i.imgur.com/KVRH1RJ.gif https://i.imgur.com/vWKkEP7.gif https://i.imgur.com/4fsbv4Z.gif https://i.imgur.com/6R1W8Ce.gif https://i.imgur.com/edzowiL.gif DMA Hardware: https://chamscheats.com/uploads/monthly_2025_02/d mamoneyspread.webp.cc1e9bdd7a3ed279414d8a6a5d87eda 8.webp
😈 1:1 DMA Firmware Emulation 😈 EAC/BE/VGK⚡6 Month Warranty⚡Never Detected ⚡ DMA
05/30/2025 - Valorant Trading - 4 Replies
https://i.imgur.com/m1KHPCP.png DMA Hardware: https://chamscheats.com/uploads/monthly_2025_02/d mamoneyspread.webp.cc1e9bdd7a3ed279414d8a6a5d87eda 8.webp Vouches: https://streamable.com/tnxbsh
[Selling] 😈 1:1 DMA Firmware Emulation 😈 EAC/BE/VGK⚡6 Month Warranty⚡Never Detected ⚡ DMA
01/10/2025 - Escape from Tarkov Trading - 1 Replies
https://i.imgur.com/KVRH1RJ.gif https://i.imgur.com/vWKkEP7.gif https://i.imgur.com/4fsbv4Z.gif https://i.imgur.com/6R1W8Ce.gif https://i.imgur.com/edzowiL.gif DMA Hardware: https://chamscheats.com/uploads/monthly_2025_02/d mamoneyspread.webp.cc1e9bdd7a3ed279414d8a6a5d87eda 8.webp
[Selling] 😈 1:1 DMA Firmware Emulation 😈 EAC/BE/VGK⚡6 Month Warranty⚡Never Detected ⚡ DMA
10/20/2024 - Rust Trading - 1 Replies
https://i.imgur.com/KVRH1RJ.gif https://i.imgur.com/vWKkEP7.gif https://i.imgur.com/4fsbv4Z.gif https://i.imgur.com/6R1W8Ce.gif https://i.imgur.com/edzowiL.gif DMA Hardware: https://chamscheats.com/uploads/monthly_2025_02/d mamoneyspread.webp.cc1e9bdd7a3ed279414d8a6a5d87eda 8.webp
[Selling] 😈 1:1 DMA Firmware Emulation 😈 EAC/BE/VGK⚡6 Month Warranty⚡Never Detected ⚡ DMA
10/20/2024 - Apex Legends Trading - 1 Replies
https://i.imgur.com/KVRH1RJ.gif https://i.imgur.com/vWKkEP7.gif https://i.imgur.com/4fsbv4Z.gif https://i.imgur.com/6R1W8Ce.gif https://i.imgur.com/edzowiL.gif DMA Hardware: https://chamscheats.com/uploads/monthly_2025_02/d mamoneyspread.webp.cc1e9bdd7a3ed279414d8a6a5d87eda 8.webp



All times are GMT +1. The time now is 08:47.


Powered by vBulletin®
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Support | Contact Us | FAQ | Advertising | Privacy Policy | Terms of Service | Abuse
Copyright ©2025 elitepvpers All Rights Reserved.