Chip vendors do the same in the course of validation, and technically even before any silicon has been fabricated, using simulators.
Sandsifter: find undocumented instructions and bugs on x86 CPU
51–60 of 94 posts
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#52Earlier quoted context omitted.
Thanks. The scale is still hard to wrap my head around but I see what you're saying. Could this tool find hardware backdoors?
I guess that if there was a special "Open backdoor" instruction which was undocumented, then yes I guess it could find it. Backdoors tend to be separate systems which pry into something larger though (like the intel managment engine being a small, separate core which probes the main system). This means you normally need other means of access to the system other than the standard instruction sequence. Again, the IME n…
I would rather assume that the backdoor can be accessed via some at least a little bit documented opcode, such as setting some value in an MSR (model specific register) or let some instruction do interesting side effects on some obscure preconditions, such as if the registers are filled with specific values, the instruction will do something completely different.
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#53Related: https://www.theregister.co.uk/2013/05/20/intel_chip_customiz... "Everybody hates the golden screwdriver upgrade approach, where a feature is either hidden or activated through software, but the truth of the matter is that chip makers have been doing this sort of thing for decades – and charging extra for it." ""We are moving rapidly in the direction of realizing that people want unique things and they are go…
Depends on how you count. Is the instruction that adds register one to register two and stores it in register three different from the instruction that adds register one to register two and stores it in register four? The only difference is the register the data is stored in after the add. I can argue this either way, and you should be able to as well (though you may find one side is a lot more compelling). Really an…
It is a difference to reserve space in the instruction encodings vs. having an undocumented instruction.
For the former when trying to encode it an "undefined instruction" interrupt should occur.
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#54Christopher Domas does some very cool work. His System Management Mode exploit a few years back was quite nice. It will be interesting to see which processor it is that he found the ring 3 hard lockup instruction in...
He works for spooks - Battelle Memorial Institute, a long-time NSA/CIA contractor. One of the places that hires officially retired spies.
and therefore.... ?
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#55Earlier quoted context omitted.
I'd never heard of Charlie Stross or his Accelerando book. Thanks for mentioning that, it looks right up my hard-sci-fi alley.
Then definitely also check out the Quantum Thief trilogy, by Hannu Rajaniemi.
Amusingly, the cover of The Quantum Thief (at least on iBooks) has the following quote:
> "The best first SF novel I've read in years. Hard to admit, but I think he's better at this stuff than I am." -Charles Stross
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#56Earlier quoted context omitted.
>> "several million" undocumented instructions.. is that right? Bear in mind that doesnt really mean that there are several million operations / opcode mnemonics which are undocumented but each distinct instructions. It is more likely they are "loose" decodings of other instructions, where changing a single bit of the opcode still causes the CPU to decode the same instruction. Toy example: If I encode my (imaginary I…
Thanks. The scale is still hard to wrap my head around but I see what you're saying. Could this tool find hardware backdoors?
> Could this tool find hardware backdoors?
Only very crude ones. A competently implemented hardwre backdoor would probably be data-dependent. For instance, it might trigger when REP CPUID is called with four specific 64-bit values in R8, R9, R10, and R11 -- and if that were the case, there would be absolutely no way to discover it by searching.
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#57tl'dr of the slides: Found on one processor... instruction Single malformed instruction in ring 3 locks Tested on 2 Windows kernels, 3 Linux kernels Kernel debugging, serial I/O, interrupt analysis seem to confirm Unfortunately, not finished with responsible disclosure No details available [yet] on chip, vendor, or instructions He's found a new f00f bug, winter 2017 is going to be interesting :)
Observation: the length of the censored "XXX hardware bug" text on the slides matches neither Intel, AMD nor Transmeta. Unlikely to be VIA too. Either it's deception or perhaps some obscure low-end embedded vendor. edit: for the curious, it's "(redacted) hardware bugs" :)
Possibly something weird like Vortex86?
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#58This is highly interesting. I assume a lot of those are going to be debug and instructions to help the binning process. Some of these might even unlock access to parts of the CPUs we aren't supposed to have access too, opening the doors to custom microcode (unlikely that anyone outside the CPU OEM can do that though) but may allow us to disable "security features" such as the Management Engine. This is a really inter…
Separate research has been done on microcode. The general consensus is that Intel's microcode binaries are encrypted, and are secured with a RSA2048-SHA256 signature.
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#59No instructions there to disable the IME?
Given Intel's behavior around the IME, I rather doubt there's an instruction for that. The only verifiable way to do so that I know of, on some chips, is here:
https://hardenedlinux.github.io/firmware/2016/11/17/neutrali...
YMMV, not responsible for bricked chips, and note the caveats at the end.
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#60This is great. That a program can learn about and exploit the CPU on which it is running from unprivileged userspace reminds me of the notion in Charlie Stross' Accelerando of running a timing attack against the universe to learn about the virtual machine in which we are being simulated.
I'd never heard of Charlie Stross or his Accelerando book. Thanks for mentioning that, it looks right up my hard-sci-fi alley.
He actually posts on here from time to time...
He's fairly prolific and very talented. The only one of his books I wouldn't particularly recommend is his first. The sequel's great, though.
Many of his straight up thrillers e.g. Saturn's Children have well realised universes they inhabit.