Skip to main content
https://img.shields.io/pypi/v/divination.svg

Overview

divination is a python package that exposes a simple interface for transacting with physical memory and IO space - cross platform (currently Windows10 and Linux).

IO and physical memory regions are mapped into the python usermode process and are transacted directly with the assistance of ctypes.

To function, the module requires a resident kernel-mode driver.

Features

  • Reading PCI configuration space

  • Reading MSRs (writing MSRs - TODO)

  • Mapping and RW from/to IO regions

  • Mapping and RW from/to physical memory regions (Linux-only - TODO Windows)

Dependencies

  • (Windows) pywin32

  • (Linux) <none>

Installation

Python module

The python module is available off PyPI:

pip3 install divination

Kernel module (Windows)

The KMDF driver can be built by installing VS, SDK + WDK and running msbuild under the driver/win directory from within the VS Developer Command Prompt.

Please do not (non-test-)sign this kernel module; we do not want to further enable attackers! Unless a restrictive DeviceGuard policy is employed, enabling testsigning should be sufficient to allow the driver to run:

bcdedit /set testsigning on ; shutdown -f -t 0 -r

Kernel module (Linux)

The Linux kernel module can be built by running make under the driver/linux directory. The usual prerequisite dependencies (kernel headers, gcc, etc.) will need to be installed.

Usage

There are currently 3 classes available: PciDevice, Msr and MemoryObject. Examples follow for usage of each.

  • PciDevice(bus, device, function)

    >>> amd_lpc = PciDevice(0, 0x14, 3)     # LPC Bridge @ D14F3
    >>> hexdump.hexdump(amd_lpc.read_cfg())
    00000000: 22 10 0E 79 0F 00 20 02  51 00 01 06 00 00 80 00  "..y.. .Q.......
    00000010: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    00000020: 00 00 00 00 00 00 00 00  00 00 00 00 62 14 37 7C  ............b.7|
    00000030: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    00000040: 04 00 00 00 40 C0 03 20  07 FF 20 03 00 00 00 00  ....@.. .. .....
    00000050: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    00000060: 00 00 00 00 40 16 00 0A  00 00 0F 00 00 FF FF FF  ....@...........
    00000070: 67 45 23 00 08 00 00 00  90 02 00 00 07 0A 00 00  gE#.............
    00000080: 08 00 03 A8 00 00 00 00  00 00 00 00 00 00 00 00  ................
    00000090: E0 03 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    000000A0: 02 00 C1 FE 2F 01 00 00  00 00 00 00 00 00 00 00  ..../...........
    000000B0: 00 00 00 00 00 00 00 00  04 00 E9 3F 00 00 00 00  ...........?....
    000000C0: 00 00 00 00 00 00 00 00  00 00 00 80 00 00 F7 FF  ................
    000000D0: 86 FF FD 08 42 00 00 00  00 00 00 00 00 00 00 00  ....B...........
    000000E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    000000F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    
  • Msr(register)

    >>> amd_hwcr = Msr(0xc0010015)
    >>> hex(amd_hwcr.read())
    '0x89000111'
    
  • MemoryObject(base_address, range, mem_type, alloc=False)

    >>> spi_bar = MemoryObject(0xfec10000, 0x100, MemoryType.IoSpace)
    >>> hexdump.hexdump(spi_bar[0:])  # MemoryObjects are sliceable and can be read from + written to
    00000000: 05 21 CC 4F 00 00 00 00  00 00 00 00 6A 00 00 02  .!.O........j...
    00000010: 06 20 04 04 06 04 9F 05  03 0B 0A 02 FF 98 06 02  . ..............
    00000020: 13 07 33 10 08 20 20 20  0C 14 06 0E C0 54 C0 14  ..3..   .....T..
    00000030: C0 14 08 46 03 00 00 00  FC FC FC FC FC 88 00 00  ...F............
    00000040: 3B 6B BB EB 00 05 00 00  01 00 00 02 02 00 06 00  ;k..............
    00000050: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    00000060: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    00000070: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    00000080: 00 40 40 69 24 6A 4A 16  CA C5 EB 7B E2 95 09 4C  .@@i$jJ....{...L
    00000090: C8 AD 4A FC CB 1D 83 A9  C4 82 C1 D9 7E 35 F9 27  ..J.........~5.'
    000000A0: 92 8A 43 4B 78 D3 6B 04  9C B8 AF 79 8C 68 C6 E8  ..CKx.k....y.h..
    000000B0: 2E 24 04 68 F4 97 2A CC  83 74 C9 E2 17 C0 5A C7  .$.h..*..t....Z.
    000000C0: C7 C7 C7 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    000000D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    000000E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    000000F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
    

Release files for divination 2.0.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for divination 2.0.1
File Size Uploaded
divination-2.0.1.tar.gz 12.6 kB Details

Built distribution (wheel)

Table of built distributions (wheels) for divination 2.0.1
File Interpreter ABI Platform
divination-2.0.1-py3-none-any.whl Python 3 none any Details

Total release size: 20.4 kB

Release files / divination-2.0.1.tar.gz

Download URL divination-2.0.1.tar.gz
Size 12.6 kB
Tags Source
SHA-256 checksum
How to use checksums
3c8e298b07b9b5ae607c9ae2f449b0b36a505421cd243d51edc99bca4e8ca617
BLAKE2b-256 checksum
How to use checksums
0055b8dcee9501f975c52ea5996a2d4d178846f4d22f672ecaae6fbad248f76f
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.1.1 pkginfo/1.5.0.1 requests/2.21.0 setuptools/41.1.0 requests-toolbelt/0.9.1 tqdm/4.45.0 CPython/3.7.5

Release files / divination-2.0.1-py3-none-any.whl

Download URL divination-2.0.1-py3-none-any.whl
Size 7.7 kB
Tags Python 3
SHA-256 checksum
How to use checksums
cd9ce9de0603abb526389c9e91ca127081ae743352562904e3826000f862f4f8
BLAKE2b-256 checksum
How to use checksums
df1aa6c648979a40215f3da12123ac2b27a28f5a97d9cc115412f622e692c526
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.1.1 pkginfo/1.5.0.1 requests/2.21.0 setuptools/41.1.0 requests-toolbelt/0.9.1 tqdm/4.45.0 CPython/3.7.5

Release history Release notifications | RSS feed

This release

2.0.1 This release

2 release files

2.0.0

2 release files

0.2.0

2 release files

0.1.0

2 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page