Omg yes, I found this borderline unreadable. So dense with clever phrases that say almost nothing. I came here to this thread to see if it was just me; I'm glad it wasn't!
I cannot wait for the accompanying Black Hat talk. Christopher Domas is one of my absolute favorite all-time hackers. He does such a fantastic job of explaining his work. Some of my favorite talks of his:
Holy shit, Christopher Domas is back. I remember watching his Defcon talks on x86 shenanigans[^1][^2] and being amazed at what he's been able to discover. Then he got whisked away by Intel and now drops this. I'm excited.
So on an affected system, ring 0 root has access to pretty much everything that was hidden in negative ring territory. The page is pretty quiet about what other processor families might be similar beyond this specific AMD16h (an older AMD low-power family)?
1) Don't give your guests access to the DCT control registers.
2) On 15h - no obvious way. I don't know the other families.
3) Yes -- this can be verified easily. Pick up the AMD 15h BKDG, look up BankSwizzleMode. It's documented. The one oversight is that this bit is not under the Dram Controller's lock bit.
I really hate to be that guy, but man, as someone who was and is a big Christopher Domas fan (and is way dumber than him, I mean, this stuff is seriously over my head)... it's been really disappointing to see him LLM'ing all the READMEs recently. They used to be a joy to read through, but now the Claudeisms made it such a slog I could barely get through a few paragraphs. I'm glad he's using the new tools to get even more cool stuff done, but I wish he'd have gone for a human writeup at the end.
I came to the comments to complain about how unreadable it was, saw that it was the movfuscator guy, went back to check if I somehow made a mistake but no, if anything that writeup is one of the egregious ones I've seen recently. What a shame, I really liked his talks.
Hackernews, dang and the other mod are constantly telling people, wE'rE dOIng sOMetHinG dIffeReNt hERe
Yeah, complaining about fucking ai instead of discussing the topic.
I don't give a fuck about how whatever it is you perceive as "claudisms" makes you feel.
The author is deeply technical, and the writeup as presented is easy to follow.
If you couldn't follow it and you are technical, then you have a form ai psychosis: the kind that makes you so hyper-viliglent to seeing something that might have been produced in a way that you don't like that it blanks out your brain.
I don't understand the threat model being attacked here. If you had physical DRAM access you could do all of this anyway right? And I would assume that an unprivileged user would not have write access to the DRAM controller registers?
You're missing that modern CPUs substantially lock the users out of control of their own computer and include things like hidden additional network connected processors that run their own full on operating systems. ... and may well be used to surveil or remotely access your computers the the behest of powers unknown.
But they still use system dram, so this approach allows looking into those parts of your own computer from which you're normally blocked. At least on some hardware...
This is the level of access the rightful owner of a computer should have to his own system.
He should also be able to fuse away this access forever, to be fair. But out of the box, when I get a new laptop, I should be able to read and write every byte of DRAM.
OK, so this works on AMD Jaguar according to the README. That's a architecture from 2013. There's notes about Zen 3 having a different base address for the memory controller registers, but that's it. What newer CPUs does attack actually work on?
This is all great to get full unfettered access to your own system, as life should be.
I’m sure Xbox and PlayStation security groups are a little nervous right now though. Getting ring-0 on those machines is near impossible, but once you do then everything else becomes wide open
Skitter creek bath salts... Or SCBS
Guess there'll be a talk called Secure Computing BullShit in the next Blackhat conf! I'll be eagerly waiting for it! :)
When I started with computers, DRAM was understandable by a teenager: RAS, CAS, read, done.
Ok, the necessary refresh was always a little pain, but still something manageable.
Nowadays, I feel you need three PhD's to even bring up a micro with DRAM and don't get me started on the proprietary binary blobs necessary just for DRAM access. No wonder PSRAM is a thing.
The corollary is that it shouldn't be too surprising that this gigantic attack surface provides many opportunities. (Of course that doesn't mean it is easy to find them, hat tip to Christopher Domas, just that I expect there to be many more).
So true. The levels of indirection from a pointer to an actual DRAM chip address are insane.
Then there's the electrical bus: DDR5 runs so fast it need channel characterisation (sorta like the old model dial up sounds) on the lines between the controller and the DRAM. No more 5V and 0V for TTL signals there.
This is so cool. Outside of a cool demo, and maybe some black hat type stuff, this is surely dangerous, a bad idea, and shouldn't be done in prod. But pure hacker ethos at its heart.
51 comments
[ 2.9 ms ] story [ 36.9 ms ] threadBut why on earth do they have to use AI to write their writeups?!
- Psychological Warfare in Reverse Engineering https://www.youtube.com/watch?v=HlUe0TUHOIc
- The MoVfuscator https://www.youtube.com/watch?v=R7EEoWg6Ekk
- Hardware Backdoors in redacted x86 https://www.youtube.com/watch?v=jmTwlEh8L7g
He did a fantastic job of explaining his work.
[^1]: https://www.youtube.com/watch?v=XH0F9r0siTI
[^2]: https://www.youtube.com/watch?v=jmTwlEh8L7g
And whether it's really real in the first place.
2) On 15h - no obvious way. I don't know the other families.
3) Yes -- this can be verified easily. Pick up the AMD 15h BKDG, look up BankSwizzleMode. It's documented. The one oversight is that this bit is not under the Dram Controller's lock bit.
“Poke the DRAM controller and an address can be made to land wherever you want in memory.”
I’d love to know why this specific sentence structure feels like Claude.
Then don't be that guy.
> But...
Oh, ok.
Hackernews, dang and the other mod are constantly telling people, wE'rE dOIng sOMetHinG dIffeReNt hERe
Yeah, complaining about fucking ai instead of discussing the topic.
I don't give a fuck about how whatever it is you perceive as "claudisms" makes you feel.
The author is deeply technical, and the writeup as presented is easy to follow.
If you couldn't follow it and you are technical, then you have a form ai psychosis: the kind that makes you so hyper-viliglent to seeing something that might have been produced in a way that you don't like that it blanks out your brain.
But they still use system dram, so this approach allows looking into those parts of your own computer from which you're normally blocked. At least on some hardware...
He should also be able to fuse away this access forever, to be fair. But out of the box, when I get a new laptop, I should be able to read and write every byte of DRAM.
I’m sure Xbox and PlayStation security groups are a little nervous right now though. Getting ring-0 on those machines is near impossible, but once you do then everything else becomes wide open
Ok, the necessary refresh was always a little pain, but still something manageable.
Nowadays, I feel you need three PhD's to even bring up a micro with DRAM and don't get me started on the proprietary binary blobs necessary just for DRAM access. No wonder PSRAM is a thing.
The corollary is that it shouldn't be too surprising that this gigantic attack surface provides many opportunities. (Of course that doesn't mean it is easy to find them, hat tip to Christopher Domas, just that I expect there to be many more).
Then there's the electrical bus: DDR5 runs so fast it need channel characterisation (sorta like the old model dial up sounds) on the lines between the controller and the DRAM. No more 5V and 0V for TTL signals there.