Spaghettifying DRAM

Unlocking everything connected the CPU pinch DRAM scrambling — PSP, C6, microcode, SMM, and thing other the specs near out.

&x == &x.

Usually.

Poke the DRAM controller and an reside tin beryllium made to onshore wherever you want successful memory. skitter-creek-bath-salts reaches into the deepest level of the representation level and rewires the beingness DRAM reside translations, to scramble level representation and merchandise its astir guarded secrets — the specialized carveouts invisible moreover to the kernel. When the translations break, the walls built connected them collapse, and we unlock everything.

• Unlock your Platform Security Processor
• Unlock System Management Mode
• Unlock C6 DRAM
• Unlock your CPU microcode

Developed and tested connected AMD Family 16h CPUs, the past procreation whose datasheets archive the DRAM controller's translator registers — and show that they can't beryllium locked. 17h and beyond simply time off this accusation out. The odyssey of *p is akin crossed generations and architectures, and the underlying transforms widen moreover to ARM, RISC-V, and beyond; skitter-creek-bath-salts shows america only really to begin.

It's a agelong measurement down.

Memory is built connected layers of abstraction truthful heavy they go almost absurd. When your codification dereferences *p, it appears to entree the DRAM astatine p. It does not — p is simply a virtual address, and earlier a azygous spot of DRAM is touched, it must survive the gauntlet below:

This task useful astatine the deepest levels of the *p pipeline, the MCT/DCT layer — wherever a beingness reside from the information fabric/interconnect enters the memory controller and is rewritten 1 last clip into the earthy DRAM coordinates that are issued to the DIMM.

Physical addresses are really much of a suggestion.

That's the exploit. All of it.

One bit-flip successful the DRAM controller rewires the full instauration of the *p pipeline, and the information that was astatine &x is now location other mid-flight. Suddenly &x != &x. Every elaborate system the CPU and firmware and uncore and chipset person meticulously utilized to wall disconnected each the astir protected regions of representation each beryllium above the representation controller, and are entirely oblivious to thing that happens beneath it. All the existing representation fences guard beingness addresses, not DRAM coordinates, and if you rearrange the DRAM coordinates, each the CPU and information cloth barriers supra them are entirely unaware.

But rewiring DRAM is easy. The spot supra is the bank-swizzle-mode successful the DCT, and it's conscionable 1 of dozens that power the reside remaps astatine the last furniture — all you person to do is flick them to make everything built connected apical topple. The harder portion past is keeping the level up arsenic the entirety of strategy representation is scrambled underneath it.

The trick: beryllium fast, and don't touch DRAM. Disable the APs, premier the TLBs, lukewarm the cache, disable interrupts, flush the target, serialize memory accesses, and dream the CPU prefetched the upcoming instructions. Then rewire the MCT/DCT to spaghettify DRAM, drawback immoderate information from the protected region, revert the mappings, serialize again, alteration interrupts, resume the APs, and everything's backmost to normal, pinch the remainder of the level wholly unscathed.

With immoderate observant setup of paging, cache states, threading, and the TLBs, the address scrambling tin beryllium made to activity from C, to exemplify the *p pipeline collapsing, and the platform's corrupted position erstwhile abruptly &x != &x:

So we tin rewire the representation and reconstruct it without a trace. All that's near is knowing what we rewired it into.

Every protected representation region connected the platform, reachable pinch a calculator.

With the supra approach, we tin reprogram the MCT/DCT toggle shape connected a running system — rearranging the lowest shape of the *p pipeline to scramble memory out from underneath each protection built supra it.

But there's a challenge: while we tin reprogram the translator pinch a simple xor dword [0xf80c2094], 0x00400000, we person nary thought what caller transforms the MCT/DCT will usage (the datasheets are underspecified present — the xor maps are off, the MMIO subtractive shape is unordered, and specifications alteration crossed models). Without this, representation scrambles, but we person nary measurement to reconstruct it.

Fortunately, the DRAM controller's reside toggle shape is simply a GF(2) linear map, which intends we tin reconstruct the scrambled representation pinch basal linear algebra.

First, see the normal case: the guardant toggle shape of the default MCT/DCT configuration gets applied to immoderate beingness address, which lands connected a secret in DRAM:

This is the coherent position of memory: the lowest shape of the *p pipeline operates precisely arsenic it should.

Now rewire the MCT/DCT shape of *p pinch xor dword [0xf80c2094], 0x00400000, and the level enters a scrambled/spaghettified position of representation wherever a different toggle shape allows an alias to scope the aforesaid DRAM secret:

This othername lets america scope the aforesaid concealed without hitting the existing platform locks and defenses built for the coherent view. To find the alias, constitute the inverse of the attacking/spaghettified hash pinch the guardant of the firmware/coherent hash, to get the translator that will scope immoderate concealed from the malicious MCT/DCT configuration:

The only situation is that the matrices are unknown, which intends we person no idea really representation is really scrambled, and nary toggle shape to usage to scope the secret successful the first place:

Fortunately, astatine this constituent it's conscionable linear algebra, and you could lick the transforms by manus if you want. Or: a calculator.

We usage z3. First, the SMT solver needs constraints to activity with.

Start successful the coherent view, modify the MCT/DCT to move to the spaghettified view, drop immoderate sentinel worth for illustration 0xdeadc0de into a random reside successful memory, flip backmost to the coherent view, and expanse representation for wherever the sentinel resurfaces. This gives a (target, alias) brace — a actual datapoint showing two physical addresses that representation to the aforesaid compartment successful DRAM. Repeat the process, gather a fistful of data, walk it to z3, and it solves the translator matrix needed to person betwixt the 2 views — immoderate coherent-view beingness reside on one side, its spaghettified-view othername connected the other:

Feeding othername pairs to z3 1 astatine a clip lets america watch the SMT solver decipher the representation scrambling successful existent time, arsenic shown successful the opening image.

The solved toggle shape is simply a rosetta stone, the cardinal to taking immoderate target reside in the normal coherent position of representation and reaching the aforesaid information successful the scrambled spaghettified view. To unlock protected DRAM, prime an reside we can't scope — PSP backstage memory, SMRAM, the C6 idle-state — tally it done the transform solved by z3, and get an othername that will scope the target successful the spaghettified view, without hitting the elaborate fences, locks, and information checks the platform constructed for the coherent position of memory. Rewire the DCT pinch xor dword [0xf80c2094], 0x00400000, publication aliases constitute the alias, its travel through the *p pipeline circumvents each obstruction on the way, move backmost to the coherent position pinch a 2nd xor dword [0xf80c2094], 0x00400000, and you're done — unrestricted access, to thing astatine each the level has secreted distant in DRAM.

In the end, everything usually truthful cautiously walled disconnected — PSP backstage memory, SMRAM, the C6 idle-state — locked-down and inaccessible from the OS and ring-0 and sometimes moreover from the CPU itself, is still sitting successful the aforesaid physical capacitors successful DRAM. But the locks and fences and walls were built astir the coherent-view of memory, and do thing against the spaghettified aliases that reach that aforesaid data.

Flip 1 spot successful the last level of the *p pipeline, and we've unlocked everything.

Tamper pinch your PSP, spot what happens.

The fTPM runs connected the PSP's ain ARM core, successful a DRAM carveout correct past the visible top-of-memory. Reach it by aliasing an OS-visible beingness address onto it, propulsion the bytes out, disassemble.

That's the PSP's RSA motor — the modexp down each fTPM signature, and behind the Miller-Rabin tests that mint its keys — lifted retired of representation the PSP is supposed to ain alone, fenced disconnected astatine the representation controller, opaque moreover to ring-0. Modify arsenic you spot fit.

Read what SMM hides.

The SMI handler introduction vector lives astatine SMBASE + 0x8000. SMBASE is in MSR 0xc0010111. Read it, propulsion the bytes done the othername map, and pipe them consecutive into a disassembler:

Those instructions tally successful ringing -2, the astir privileged discourse connected the CPU, out of representation the chipset is expected to make unreadable. SMRAM "locked" turns retired to beryllium a polite proposal erstwhile we tin talk to the DRAM controller directly.

Swap 2x4gb for whichever prefix successful data/maps/ matches your installed DIMMs (sudo dmidecode -t memory). If your topology isn't there, run analysis/gather_aliases.py past analysis/unspaghettify.py to bake your own.

I person nary thought what's successful present and person ne'er seen it discussed, likely internal CPU registers. Have fun.

When the cores power-gate into C6, each one's afloat x86 architectural discourse is stashed present for restore.

One halfway pinch the BSP spot set, 3 without — the footwear processor and its three APs, caught mid-idle pinch their registry authorities lying successful the open.

The much you flick around, the much CPU registers you'll commencement to find:

Of course, those registers are each accessible from ring-0 anyway. The fun portion is successful each the other CPU authorities sitting location — poking the internal CPU registers ring-0 can't reach.

What could spell wrong?

When a halfway drops into C6 its microcode spot RAM — volatile SRAM — goes acheronian with the remainder of the core. So the C6 stash keeps the loaded spot successful DRAM and re-seeds it connected wake. That transcript sits astatine +0x1800 successful each prevention area, and the othername reaches it for illustration immoderate different byte.

Grab the microcode transcript the CPU stashed successful fenced DRAM:

Match it against known patches:

This is simply a bully sign:

Extract the ucode triads:

And location it is, chopped uops up top, NOP padding repeating below.

From there, dram_dump has a related tool, dram_poke. The aforesaid othername that read the spot tin constitute it — and this transcript is the 1 the halfway reloads coming out of idle.

What you do adjacent is up to your imagination.

Run arsenic root. Full specifications successful USAGE.md.

Simple publication from a protected representation address.

Push the --do-swizzle / --do-bankswap flips into the DRAM controller to enter the spaghettified representation view, publication 1 dword from beingness address <pa>, reconstruct the DCT bits, and return the value.

Write into a protected representation range.

Each --map is simply a solved spaghettification from unspaghettify.py --save-map, itself fed by othername pairs collected by gather_aliases.py; the othername for every dword successful the protected scope is recovered from the representation via a GF(2) pseudo-inverse computed erstwhile astatine startup. Pass aggregate maps — 1 per (at_swizzle, at_bankswap) gathered connected the aforesaid hardware — to widen coverage, since each spaghettification leaves a different group of rank-deficient holes and the first representation that reaches a fixed dword wins.

Read from a protected representation range.

Same --map machinery arsenic dram_poke: each representation is simply a solved spaghettification from unspaghettify.py --save-map, the othername for each dword is recovered via a one-shot GF(2) pseudo-inverse, and aggregate maps gathered astatine different (at_swizzle, at_bankswap) widen sum wherever 1 map's rank-deficient holes are filled by another's.

The afloat toolchain — dram_state, dram_carveouts, and dram_alias; the gather_aliases.py / unspaghettify.py study pipeline; worked end-to-end examples; and the internals — is documented successful USAGE.md.

skitter-creek-bath-salts explores really the last stages of the MCT/DCT transforms tin topple the information of everything built supra it. The exploit demonstrated present is 1 configuration registry connected AMD Family 16h, picked because the datasheets gave capable to begin. The pipeline it collapsed is everywhere.

Channel interleave, rank interleave, slope interleave, swizzle, chip-select normalize — each modern representation controller does immoderate type of each of it. AMD. Intel. ARM. RISC-V. Mobile. Server. Embedded. The aforesaid architectural shape sits underneath everything.

Above it each sits SEV, SGX, TDX, TrustZone, CCA realms, pKVM, CoVE, SEP, the PSP, ME, T-SEG, SMRAM, the C6 stash. Everything sitting successful DRAM — moreover things walled disconnected and invisible to ring-0 aliases the CPU itself — rests connected the last layers of a *p pipeline we've conscionable begun to explore.

• Black Hat 2026 — Spaghettifying DRAM (Coming Soon)

skitter-creek-bath-salts is simply a investigation effort from Christopher Domas (@xoreaxeaxeax)