Are there any examples of using this for non-nefarious reasons? For instance, could I add new instructions that made some specific calculation faster?
Zentool – AMD Zen Microcode Manipulation Utility
31–40 of 69 posts
Re: Zentool – AMD Zen Microcode Manipulation Utility
#32Something worth noting: CPUs have no non-volatile memory -- microcode fully resets when the power is cycled. So, in a sensible world, the impact of this bug would be limited to people temporarily compromising systems on which they already had CPL0 (kernel) access. This would break (possibly very severely and maybe even unpatchably) SEV, and maybe it would break TPM-based security if it persisted across a soft reboot,…
> enforces its own firmware security instead of delegating to an independent coprocessor That depends on how we define "independent" - AMD's firmware validation is carried out by the Platform Security Processor, which is an on-die ARM core that boots its firmware before the x86 cores come up. I don't know whether or not the microcode region of the firmware is included in the region verified by their Platform Secure B…
Look at tests/stop.sh and check the different segments (ls:, ms:, etc you can also address them like 0:[..], 1, 2, 3,... 15:[...]). One of those is probably flash. If you know how that looks like try to dump it first with a load and then check which segment and which address it is at and then write back to it.
Re: Zentool – AMD Zen Microcode Manipulation Utility
#33Earlier quoted context omitted.
SEV attestation does delegate to the PSP, no? I think it _might_ be reasonable to attest that upgraded microcode is both present and valid using SEV, without the risk of malicious microcode blinding the attestation, but I’m not positive yet - need to think on it a bit more.
This probably depends on a lot of non-public info: how does the PSP validate CPU state? where does PSP firmware come from? can the PSP distinguish between a CPU state as reported by honest ucode and that state as reported by the CPU running malicious ucode? I think that, at least on Intel, the “microcode” package includes all kinds of stuff beyond just the actual CPU microcode, and I think it’s all signed together. I…
https://github.com/amd/AMD-ASPFW/blob/3ca6650dd35d878b3fcbe5...
Re: Zentool – AMD Zen Microcode Manipulation Utility
#34Wow, so providing a tool for bypassing the protection mechanism of a device (cpu) is accepted when it comes from google? Try this on any game console or drm protected device ans you are DMCAed before you know it.
Re: Zentool – AMD Zen Microcode Manipulation Utility
#35Are there any examples of using this for non-nefarious reasons? For instance, could I add new instructions that made some specific calculation faster?
It's interesting to think about the sorts of things we could do if we had low level control over our hardware. Unfortunately things seem consistently headed in the opposite direction.
Re: Zentool – AMD Zen Microcode Manipulation Utility
#36Doesn't changing how your cpu's microcode works mean you can bypass or leak all kinds of security measures and secrets?
Re: Zentool – AMD Zen Microcode Manipulation Utility
#37Wow, so providing a tool for bypassing the protection mechanism of a device (cpu) is accepted when it comes from google? Try this on any game console or drm protected device ans you are DMCAed before you know it.
Same with apps, aka everything is opensource if you know RE ;-)
Re: Zentool – AMD Zen Microcode Manipulation Utility
#38Wow, so providing a tool for bypassing the protection mechanism of a device (cpu) is accepted when it comes from google? Try this on any game console or drm protected device ans you are DMCAed before you know it.
‘In the courts, you will be deemed either innocent or guilty, according to your wealth or poverty.’
Re: Zentool – AMD Zen Microcode Manipulation Utility
#39Wow, so providing a tool for bypassing the protection mechanism of a device (cpu) is accepted when it comes from google? Try this on any game console or drm protected device ans you are DMCAed before you know it.
We live in an age where it's okay to pirate terabyte of data if you're Meta. ‘In the courts, you will be deemed either innocent or guilty, according to your wealth or poverty.’
Re: Zentool – AMD Zen Microcode Manipulation Utility
#40Wow, so providing a tool for bypassing the protection mechanism of a device (cpu) is accepted when it comes from google? Try this on any game console or drm protected device ans you are DMCAed before you know it.
If more about morals, generally publishing vulnerability research tooling is business as usual for white hat vulnerability researchers, working at bigcorps or not, and has a long history. seems surprising to see this kind of "not cool" comment on this site.