Bestand wählen
Merken

Everything you want to know about x86 microcode, but might have been afraid to ask

Zitierlink des Filmsegments
Embed Code

Automatisierte Medienanalyse

Beta
Erkannte Entitäten
Sprachtranskript
a it was the
end of the and and a a but In the long oral former abilities to improving low-level defenses please give a warm 34 C 3 welcome to mean Phillips thank
you thanks for this for me thanks for coming to the come today the depressed and all these sorts of Michael called around this is joint work of all colleagues and all supervisors home University Paul form and 1st of all I want to give a small disclaimer on the technical details in this talk are quite specific to work in the UK 10 and k processes and the newest release process or that I'm most stuff rocks of those from 2013 from and also all most of the findings out from grows engineering so if you want to replicate experiments at home please proceed at your own risk because you made got unintended behavior and the CPU so let's get started
on 1st of all I want to grasp that generated the what microcomputers to of on the architect to crash cause no no so fully explored expression that our detectable and in the end of it is and the more time so 1st of all what Michael
calls on this this is used if you want to you can of imagine Michael called to be a small computer within your CPU which us all sorts of complex things that will cover in this talk and see how we can deal so
1st of all I want to know if some previous Roque from 1st of all there there a ain't the patterns that are publicly available and very difficult so general overview of of the Micro architecture details so the nested upside to
architect and there's an brother detailed article about the physical placement of specific components on died of and then there's the and was not possible to solving for optimal poles and basically that's reviews for the 1st time that the microcode is updated and that some into CPU was even we accept Michael called if they are modified and the text on this corrected so this basically was the initial idea of our research and then
there's some that paper secure genesis of excited exposes some like a cold day a couple of mostly from the security of stuff related about semantic adopted from Internet endoprosthesis and so on if a general overview so then there's so broke off of goal and he's he probably has some intimate knowledge of ions also be doing really cool stuff alleging microcode so the
know in all but my code is somewhat related brokers and that's if you look at some what it's actually useful so 1st of all it's useful or instruction decoding and it's used to box to fix box and CPU was that interviewed already so they already hold Alt and its use for exception handling on the architectural level sold to some if there's something in that division by 0 for example this abuse somehow needs to detect that and tests exceptions and the information to the operating system and this is how the model called puzzle of microcode is used for Apollo Management CPU and can be used by the Vandals tool implement complex if you features like interested for some a vol the here that's the microcode is used for instruction decoding and the known so the light this soul that x 86 instruction architectures quite complex and it had the same variable length instruction set as he can see here this instruction formed by an instruction is several bites and mean you should be in the 1st point indicates how long such instruction is which helps a during the decoding process but of course is an exception to this there are of instruction prefixes which delayed the decision homonyms structure is going to be 1 for the boys and the top of that there are several of tools and they can also be applied to combine combined to form all kinds of a complex of instructions also there are some of the instructions that extensions of the give of a vector of uh the floating point addition and substraction this picture of positioning floating point units and on construction has several operand since quite complex 2 of the court and later on also quite complex to execute lot to be executed within the CPU and to to this complexity you need some In of small computer within our CPU to actually Dakotas arms now they're going to Creek look at how this decoding looks like and we have an exact physics instruction on the left pop the peaks the dereferenced and so on this instruction gets decoded to 7 microcode constructions all my co-ops around on the right you can see dolls and at 1st you don't read the top of the stack and to Lotus value and kangaroo because that produced after vaults the statistic it's stored in the location indicated by the text and afterwards distinct point gets incremented so he also uh just heard that michael code is used to update the CPU was that I ever lost and that all in the future and and this behavior probably is motivated by the infamous into pendulum if the spark in 1994 pursuant incident impostor source votes and produce some slightly off for solids fall so floating point operations on this was quite an ascending into that appear Tom to complaints processes and the so of both things and and you wanted to avoid this in the future and so at update ability so 1 example of this year and there was this internal KB Lake Park and there are certain hyperscanning behavior of or so I was having conditions would lead to instead system behavior and and this part was fixed to my update so then we have so that in the side also some a box there was a in Diefenbaker in 2008 and there to the entries could not be the case to reliably and this book was also fixes my coat so so again quite recently this year there was in India whose and back the which was a good expired Michael code so let's now have to
look at 2 in the groupings of Michael architecture and a whole Michael microcodes is invented in this and so on instruction-giver executed on the CPU and the 1st of the it gets from main memory to the caches and at some point of that circuits with a cold engine and the going gets decoded to my crops they um to Michael southern scheduled possibly only to the pipeline in the pipeline thing leverages to uh no morals of functional units like and admitted logic unit or aeration units of and cover little to actually executing Michael instructions and then I was alluding to the colder than have a closer look there and we have construction buffer that stores the growing stream of bytes and several other kinds of the code and we have short coders that can each translate bond simple exhibited the instruction to 1 my co-op and pick them together and then put this text to get us ing into this gets too low then we have the of non decoder there which is able to from some translates complex or more complex exactly constructions that is to several my crops now we get to the most interesting decoded which is typically called on the right and this is the coda contains the microcode engine and an excitatory construction that gets decoded by detected a colder actually triggers a small microcode pull from to be running the thing is if you will and does not couple person may generate an arbitrary number of micro that then get scheduled to the pipeline and executed so that the just wrote that this in the CPU was certainly Michael programs are and so they need to be stored somewhere them and there's an on-chip from the Michael could from the 2 stores the Michael cult and basically also the matter Michael programs so and you have like program and during runtime and deceive you can get a microcode update and like could opt gets to automatically granted that you consider and then there's all kinds of tributary around to make the whole scene broking of for example the addition unit that increments époque encounter for the microcode engine and most importantly for us arguments with justice and they basically provide us with breakpoints In the microcode ROM and so those breakpoints can be sets at so microcode from home addresses and bonds of such an atlas gets executed the contolled directed to Michael run that might could update is thought this is a very important mechanism for Michael quote updates to actually you know me get control of their own off things have been happening in the CPU and so changing behavior of like sanitizing that's enticing inputs for instructions for example so how do we actually updated systematical for a CPU core but they need to be become what we need to know the microcode opted into the RAM the continued to write a book to match those of updates into the given the mission-specific reduced only nested Mike without that gets us about gets loaded into 2 microcode called run some those updates on a consistent and wants you have pulled office at the CPU that's in its initial state again so the microcode update farther from what you can see here only contains and had the overflow several fields such a state pitch ID and check some uh and and and this is followed by the match with justice which contain the contents for the 2 of break points and after vaults do Michael funnels Michael cordless phone old of so-called trials and bond try contains 3 my and phone sequence of Michael upside to you of microcode instructions that execute cold and the sequence words and this for control flow Pre direction so now we want to answer the question whether this is so of the loans that updatable and you have updated drivers any different biases and also the Linux kernel so we know what the procedure hold up there on behalf of origin and microcode opted spidered and loss of their distributed through bias updates and called would also has some quite a huge collection of them something old Optify from art and there are hints that does most common cryptography protecting the integrity of too much could updates
so all of this is the heck stumble fun of aftermarket updates just want to have a clicker plants are they can keep the here only a repeating value of over and over long way to often and if you had a column or the use of that of the same values we can basically see patterns emerging so meaning we have moles home-cooked
to apply and so the fluent distribu accepts modified opted if the checksums corrected so yes effectively on on at this point we knew that we had to generate a lot of my the could opted ultimate manner of to be able to look up triggers for behavior change and from that behavior change know some of the Brookings sold he did a framework and so on the framework of contains all of the notes and the old wrong all own custom-written x x 86 of when system that's some very low noise environments all become told all instructions that get executed and development of operating runs on the computers a poet by in processes so the nodes are connected to a raspberry pi of the Asturias of for data communication and the usage you buy opens connected to the of research and policy which is on fundamental bullets to automatically Pollock and on and the receptor notes the the thing the nodes execute when the microcode they often hanging on us a cover but so the whole set up a suitable to from the internet to have remote access and uh just as a
convenience feature so this would look like in the very beginning at our home this is for that looked
like mad at University and
so now we have to do the tools for automated testing and use that for generating heat maps the so that the name to the misleading but let me just explain what do you prefer that I hate that has to be on basically it's a mapping from Michael could home addresses tool with the corresponding x 86 instructions from the soul and makes it is a construction as implemented in like a court of law and the Michael COLT is located at certain home addresses and the method basically there's which home at 1st implements spot x 86 construction and the generated the net by and iteratively you hooking all the like cortical mattresses if the point with justice and then executing all of the accessory construction I yeah OK so of to if the heat maps we can reliably and execute all this as Michael caught by just from setting the breakpoint for just 2 of the norm of location and executing the corresponding x 86 instruction and the complicates redirected to high of all own Michael called and updates and you can just put women but still this abuse in the produced and that's caught and executed so because there's no documentation on of the micro constructions that's the basically you have had to conducting unknown structures that analysis of the black box model because there is no publicly available assembler-disassembler compiler of any documentation uh but luckily we had the oracle the CPU itself but you can just fitted imports and an observed of outputs and found differences in behavior because infra structure according so we know we have a trick local hold the CPU Oracle looks like the 1st if you didn't makes it affects instruction and if you do and initial state from which basically contains all of values in X X is X produces and defeated the mother could opt that these generated on our own the metric as it is on the corresponding much because that would extend the construction to be executed sold that of numerical co-ops that also contains MCW adopted and that the food and that's get executed by the CPU after what's on get on an output states of the basically of rose to states the CPU is been after the executed all random bits as Michael calls but very often this view executes when impetus Michael called this if you put just crashed and sometimes Cupertino differences in the input state and output so after some peaks of of pooled forcing pretty much the finally got to and of the training that will not press CPU and that would yield difference in the input and output states and this basically was sort of early attempt an initial step for further analysis and now of course you want to know what this strings actually doing so what operation is an executing and so to get that he started to talk of bonded by 1 in the bitstring that the font randomly and yet the change that's on the very right and you saw that output changed again and so after of changing the bits in a very wide several times and looking at the outputs and inputs we finally concluded that this that's 24 % and IEEE x at immediate instruction all like to call them so the and I use that knowledge to of Buddha small database of opcode operating some of quot fields and you can see that the determined the length of the media the opcode field and so on put it down so if you change other poets like some but more to the left begin other outputs uh we already know or the right to immediate field if you change the media it's got do yeah it's all put it changes again but it changes differently and if you look at the binary representation of the inputs and outputs the candy after several attempts over can infer that the phonics or so after some more testing the found that the operation field has a certain things that can be seen on the slides and so you can did the fast basically all starting point love and be leveraged to frame broke to conducts a lot of testing and the idea sometimes more randomly sometimes less randomly of talk bits and selected that the food adult ports to be interesting so that we only had to look at a few of the set of all ports and interesting outputs of this if you didn't crash there are changes in behavior we also have 2 miniature adults on when the noise that some sometimes occurring and then after a lot of work going more if a country did and we got to do this to of so we have quite an exhaustive list of the operation the feuds of that are sometimes immediate sometimes with just those qualifies fields and if Flexcar propagated or not and so on so all of 1 other thing to be funded to conduct this to infer the logic of Michael quote From try it's so try it's a distorted michael from the concrete and because they are in like a quote from areas under diets service so we wanted to indirectly behavior of some of those from the 1st to to play point because at a known address to get significant for it would then exocuticle responding executes instruction to get cont hole in all fields like could run stage and he would then writes Michael college and all updates to jump back to Michael from to execute this home at 1st that evolved analyzed on the then it 1 to this address and put this at 1st to another match just to jump back to all my quote from that RAM so a 2nd medical could run states and this would then mean all put to you of the the solids and so that they can compare input and output state again but this time didn't execute all the random walk this random but string but the executed only Michael trial that stored on the wrong and this approach has several topics of football of 3 Micah quote home tries to might just modify some in terms of you stated that you don't know so they can't really observe fertile crescent that's and other disadvantages that the microcode 1 try it may not execute the twice born at 1st of further but it may just jump some that's not a quote from in this case you would lose the control but some be designed on my quote from from stage to not not noticed this and some people just call from another Michael Tom tried in this case all
quite late in all projects and you decided to work for the tried and to my quote from from the CPU by itself so of the the capital and delay let the chips and so I talk about short looks like this so maybe you can see in green the the could from areas so they take quite a bit of the CPU surface and features on the
model systematically microscope you can start to see you that's and patterns and the shoes woman even more you can see you my thoughts that are available to the left or to the right so that means they either connected to ground ought to be see and that in turn means that this specific cell this representing the 3rd 1 was 0 on the use of degree currently the commission to the get and that's a most of the bits old and according to the after some re-arranging because the physical layer ought to the bit strange to us off the guys at this so you could actually find like courts the instructions in their own and that's the challenge to us and to get the exact mapping from the physical layer my cortical mattresses so let's think of
all of us into a solid through click so the generated those heat maps the phone to the until the 29 Michael ops so these are not cheap arithmetic operations memory loading stores so we can try it sticks 86 book encounter and they have Michael called conditional so we also propose a new features of this sequence of example can be used to just executing next try it on it can be used to signal sequence complete of the 2 means that the decoding of the current X the construction is completed and that the next exit to the construction would be executed and they cancel it can also be used to prolong sniffin Michael called unconditional and then we also composited substitutions in and subpages lensing can be used to automatically you put of of operands that are in the x is the construction tool to my construction so that an you a x in x 86 instruction would automatically be you X in microcode function as well this so heavily simplifies the implementation of excited instructions symmetrical so we also want to augment exactly the constructions of mountain all they can just a key place the not too complex it is a construction by the setting a breakpoint adjusted to the entry point and of writing all microcode data but he also wanted to extend existing no chicken crosoft Overton semantics and they can do that by eta jumping vector on to execute don't try it's all our fault simpler exactly the constructions we can always all emanate instructional logical status and there are some examples so to and once the reverse-engineer the executrix Michael called instructions some of it can be started to implement all microcode programs around them the 1st by a program that you brought in simple instrumentation which is just a poof of concept modest it's a pretty much just the microcode columns how often a certain is a construction was executed the man not instrumentation the implemented as a small framework to that and also true coke X it is a constructions and b . com told to an arbitrary function that's implement and see for example so we also implemented some of the more like the cold it takes so given their vector of the CPU on that has the big implement the Michael called on if the computer of the sits on that side I that native speaker due of the vector and the implemented sample that science that so can click on such my code vector and you have 2 versions available the bombing of some kind of is interests among the on the also implement some might call a program that's contained cryptographic Trojans so there are and harder to detect and to make the code of the cryptographic since you don't introduce a times I channel in a constant times the implementation of what they allow to of injected faults To enable for the takes on a cryptographic primitives so now we want to have a quick look that's all such Michael poking looks like only the year Michael program is given in of all mean participants so that the language that the 2 but not to implement multiple print efficiently so that you don't have to put together a long of streams of bits on all so the 1st structure you can see you this abstraction that's actually used as to compare so the value the T 1 B which is in like according to look at just stuff as compared to the value in EAX after wards follows a conditional jump and you want to 1st consider the jump not taken of and that's here and this is so just cut off instruction that's only set up annotated and here we see in the very last instructions that you jump ectoderm adequate 1 soul what's happening in this case is that some we mimic the set up often in such a division and then the jump back to the origin of triads mom to just continue to normal integer division process no the considered the jump taking that's only gets executed after you in IEEE X matches the value anti-bonding In the specific case of the year at 1 to 2 poke encounter and then the writers of the you will to the extent you think spoken condoms so just basically means that despite the court vector if you were in boat compare yeah it's to oscillometric value and if that's so that you can use font then the eccentric spoken countable be incremented by 1 which means that all successive exactly the constructions will be executed Altaf the Altaf alignment officer aligned and this is something very useful primitive that can be used for the JavaScript exports for example with all the presence of a pause a park so now that's the more time and I'm handing states to Benjamin OK so few
have of the form of the disease is me that this 1 in an old and sees you and it is actually you can target was only what programs and it those on the lower end the book you through the book and actually will loaded inside the you know and I Buddha duos download Lenox on and this is just some of my put that through and velocity those of values that you want to go on and then it forms on magic and as a don't want it effectively to get this value and the actually and an actual the magic and the um you read out what uh what of swidden inside in memory and was important you see in a 2nd and I show user actually it was a lot going on but essentially you read out as a my moving and place that's inside of atom just and performs in admitting on and then implements actually as actual semantics of shift yw ridges and if that is it's of code and you do this because if you which really didn't match you don't want to uh and you don't want to cause any trouble because some sometimes a common I might use this instruction or some other law education on your host system might uses instruction so it is important to preserve Semantics if you don't want to your vector so at this point uh um we know whether or not a chicken and we can do we can know about that condition the at some that used to adjust arose or otherwise modify them and we do exactly that and the 1st three-year condition is that the X 2 11 uh which happens to be the next agree users go online and then use that someone's registers and that we need to actually launch answers system call is of a man to control and it uses for and what the justice and in the end you condition the year I y the book encounter our and used as a great you give may actually in the gym as they look so is agendas the payload you can't use may want to go and this all happens conditionally it only triggered us if input was instruction matches homage constant and how did we achieve it and this is of the assembly module and a carefully crafted som that appellations that contain this alliance in statistics instructions and as you can see the end then entered into a cone so the trigger an exit the system of yeah and about all we reading from is shown John you and essentially we just say please was a ECoG and the this is
an unlawful unmodified Firefox and haven't added any and go to it and it's not learning will this was enough so I just cabinet and because
attitude about legal play 2nd yeah the it because the PC actually really slow especially field about Firefox
mentally man just gone steps was an instruction set
of thought of as a group they you to move that was set in order to get that was I want to go to and no inside so that silly model showed you earlier as as all coders invisible Firefox doing on time so an attacker is free to choose and would coach of the emitted by providing the appropriate that simply a module and as you can see that this execution of OSHA Freud's idea of code and get you Bechtold's Aswan and what i'd took special care of misplacing I'll constant inside an interest so actually of vector which Reagan and because the PDB is gonna lose control in the 2nd and energy to the it the and I know that people jump 6 but more so just at 6 yeah and continue
and it is aligned inside instructions and as you can see in and you perform all the things we actually coded into the microcode to prepare the augmented assess and if you if you
compare it was it was in the output I said he's images of followed by John 5 anti-Semitic lastly these geocodes and basically these codes we have
so that's just continue and help works this time and of President and it just review on the outside of the energy to be the at
the yeah it and
the girl was the theft and all of what is that CMOS implement the but rules and because the good for this rope and emotional user and doing case for us so we have hero only if the
standards are signature verification and adjust this relative job because everything is fine but not all of you are going to take the appliance the spectral yeah and to address focus coma and because we need to somewhat as update
and why this actually roots I'm gonna show you a different you I have
come this Council is actually going to push a trip to escape I'm going to sitting in the binary assembly and this year and this is going to be as union bound to an empty node and that is going to on the microcode intelligence and trust and then the show you what happens if I just say don't look anything in the microcode so you just go out and say 1 and 2 and so just so you have to pay attention to is commonly it's 0 because I didn't I didn't change anything and now I'm going to say OK let's look at yeah it and suddenly is something changed and what changes this is the microcode approaches the CPU and all the dust is portion and the next big 36 construction and to be executed and stored on the stack and then just jump to a location IP defined and this location ends up although they so we had to get control in x 86 have a old having to write any of like program that rewritings of just groups so there's also something we can do we can introduce Ludford Michael troops and actually his you finished building so let me quickly set up in the again the so it
it
so that it OK
so again we only deceived by this time you would at a different update for example this update will trigger the Johnny place in 5 but instead you're going to on a trip to the millions of reform again and suddenly they a similar signature on because we introduce an error into the calculations that's for from doing is a political graph I market elections and using this and you can actually perform the graphic attacks and just a bit of cereal
um I introduced and and cryptographic and uh the uh the snow's into other was attribute to by introducing an arbitrary error and using this you can have a construction material and all of this is done in microcode alone I didn't need to modify them by that is 1 so old that is those few to introduce you that you draw was that of warm you can't you can push any update that as a or I mean a modified advise caution distributed accepted you can think it as a and you can really think that because you would need to do a lot because you introduce sample Walker because checking and of course you can think you fix that you just accepted mechanism all but invented in that because you only have really strong InteCom or someone had to actually of modified about us to apply this on every Buddha so usually there's no problem for you and in that yes my and microcode can be roast and you can change and if you want to talk a bit more about it or even try your hand at modifying Michael put yourself visit us at 6 years you been and binds duties assembly and we have a set of results including the CPC and an old and that you can put it life at once 0 and less and also proportional simply updates and we get flies to get up including to drive can Petulancy view but please be careful this can achieve like this if you mention glycolysis but the manage was settled by sitting at some point so if the careful and few have not have time for questions from the audience at the microphones around the region with numbers on them on the internet we have a signal into was already telling me that we have questions in the internet before we get to the questions I said in advance you may be asked to leave the hall entirely when going back and now masking is that when you leave please leave entirely and re enter the whole of the main entrance of the whole the whole message here so now from the signal angel maintenance that you use the the she came from the 4th 1 is it possible going to cause physical damage to his you using malicious is Michael called his little you will you will read you that didn't we didn't like interviews that apart from the ones we want to get to be the captain to put into microRNA little microscope and maybe it is possible and we have managed idiots by our deep in the design of these entities we analyze it doesn't look like you can and under the eyes on the future and so it's like a code that can trigger on we haven't found it yet maybe it possible bonds most likely is yeah microphone sects and yes and is it possible to fix performance issues require grant so all of these sort about that as well as for example for Binary Instrumentation there are several different approaches to that you can emulate the cold on lies of all kinds examples the more you can instrument the called statically and but they all have like topics like you their so all of them a complete like the static providing for example at least not completely general soul Michael code can actually be applied performance and complete the instrumentation of basis that the instrumentation for angle based on and the problem of mother code orders that at the moment it's it's quite limited because for you are in the CPU's and pretty much fall consists of you might call disclosed parts of it maybe there's a few vendors will open it up a little bit and it could be used to to increased performance for instrumentation frameworks and it can also be used to of implement new instructions on the part I felt that it's going to be you know of a faster than if you just implement the x 86 instructions microphone is a have you looked at the older in microcode update as well because if you look at them they're like encrypted but it's clearly not strong crypto it's either a constant stream side for a smaller blocks for so long because also right the users exceeded actually loading patched microcode that have been able to control the contents but to clearly the verification mechanism is the very strong leader so OK we didn't have a close look into all of internal updates that's a very good question and you should probably have discussion offline so all of the freedoms does that SMT and they can have a look the optical you microphone to lecture it is it's referred to the microcode as a RISC architecture of and this of any instructions and that he wouldn't typically find on on a regular um RISC architecture and so but the question was better is the use of such like architecture so I can agree on that from the of instructions are mostly of quite simple of long quite interesting features Feature actually is that you can have them as free-operant motivated computer screen registers and you can have on detonation into source justice which is not possible on X X is accessible the but it's possible it might call them so it's quite interesting back to the signal angel I think you know how do you know the like a cold entry point for a given instruction on expression come on the show you with the heat maps and to generate the bottom of this year's setting a breakpoint at each possible Michael could form at 1st and
then just trying all x 86 instructions and obviously sometimes he would have multiple its full in X X is the construction because of me not von home enough to implement the whole x 86 instructions and about you then can do we have match because they're so we can set a breakpoint at forms of justice at the page break points at those different locations and see which will get sick of 1st and so we could actually you step by step in the park and in which portal Michael called home addresses get executed and to implement an exit to the construction and still be undeceived also find entry point microphone 3 you buy it is said that of those might recall that these are not resistant across remote traits across a processor is set to the others being that when vendor issues a microscope would update heat is actually a problem of NO west bias that should install their update on every point in input sequence like right you have some Solti secure and all don't published as much about this but they put them on the distance to the main books and also amenable than those who should be put them the into bias all we the updates and of those updates that contained in my code updates and doing what they get is that I'm also there actually is an on-line Notes as the mind into my good package and this section much would update on if you don't and I actually ejected strive on to perform all custom update so depending on the loss you want music from you by excluded from your system microphone for and I wanted to ask them you mention it might be possible to use crafted Microsoft the microcode to update to actually patch also update mechanism all hot think it could be to to implement this to implement sat inside say graduate and make sure sets so microcredit update mechanism dispatched starts very early on in the process so this will actually be quite easy to do so it's the 1st some knowing broke on all sides of parts from 2 heat maps you already have quite a good understanding of that amount could update mechanism is probably going to be because once you or set breakpoints they are can't apply might could updates more of soul from the class and broke down but it would be quite easy to to just so have microcode update mechanism in the world and variability in the buddhist disabled update mechanism you it's thank you very much signaling can you use this church of that this CPU is being any G piece of securities like GP in like of entities in this and probably not he's not a named him about the country value as definite answer to that because if you speak and control or don't have and secure enclave read tested and what we actually observed is that the microcode follows the same permissions that the code for that you traded the called for example if you have an animal uh the Carmichael that follows many protections so most likely no but maybe the content microphone to so you say you a trend in I and microbes do you need a lot more how much of the total of space that supported the losers so do you think our son microcode instructions you wouldn't find yeah those so borders so it's very very likely that you didn't find many of those instructions from their us to the of certainly regions within the model for the structures that we don't understand and if you talk with them is precious ordered behavior is different and you can't tell about operation it's doing but also they can just stop so some of the justice and become of so called until the rocking of the CPU sold them a lot of instructions that are modified until instead of CPU let's say it's enabled so to say that some features of 1 neighbors and the same with certain small test tests for some features of the you don't notice that and the due to that the kinds of but we don't know what the instructions to during testing currently so probably done instructions don't know microphone 1 5 you considered ways to say why get if my microphone is being backboard to detect that the k you can you help me in that situation the OK and so I'm during our research we didn't have to look into this yes but the idea head of some of the infinite as conscience regarding the point that's that's a really good question so all of the fuel that you use my call tool coke and x 86 instructions you would introduce a small title ahead and you should carefully measure that instruction you can probably detect that suddenly it as the exarchs its structure is doing more than it should actually do so you can detect most often um but it also depends on Michael code is doing not only decoding is using the talk but also other things in the CPU soul you might be able to hide torture there that some on not of detectability city which microphone to again and considering that you can basically arrangement lament instructions could be implemented completely friend instruction set up and you could do this and so I showed you in the of local in the postal talk from people and he's actually doing something like this so yes as possible from the US to look far enough of all knowledge to 1 of spots so we use these supporters of the get some interlude insights microphone to OK 2 questions actually the 1st have you found anyways to a trickle co-processors that it's sexy Higgs 86 has money off sold on let's say a floating point unit and not extensions part of it didn't look into that part of on there in the century all that there must be some way to do it Our can 2nd question there was a much better decoding the isn't there those short operations to show how they are not going to this Michael cash and or to alpha is my decoding and directly emitting those instructions say they saved in my code cannot be altered soul from the soul to call those of day translates into the exarchs its instructions and so on on the you know that there's also value tool of hope not microcoded instructions so they are not safe the noted this mechanism exists but didn't find it it like you on 1 the height the maybe you said that there is a but the DDQ contact into the you'll get any feedback so all of the did not contact until around the context Indian the this so broken so also published on the next and so they longer than 90 days before the sentiment that the results and findings and to ask for feedback and they didn't communicate much of us probably because they already have an up-to-date of secure what Wallace attribute already know about the come from tool of protection mechanism for Michael couldn't place for the latest CPU architectures so there are probably not that interested in this and I think that's the worst is not being around all this right and was
thank were the 2nd time in and the if the cat could check the act but back
Humanoider Roboter
Prozess <Physik>
Datenreplikation
Entropie
Zentraleinheit
Beweistheorie
Quick-Sort
Arithmetischer Ausdruck
Architektur <Informatik>
Physikalischer Effekt
Mustersprache
Systemaufruf
Computerarchitektur
Computer
Zentraleinheit
Komplex <Algebra>
Quick-Sort
Demo <Programm>
Mikrocomputer
Umwandlungsenthalpie
Polstelle
Computersicherheit
Dreizehn
Physikalismus
Familie <Mathematik>
Zusammenhängender Graph
Zentraleinheit
Internetworking
Kernel <Informatik>
Stereometrie
Einfügungsdämpfung
Richtung
Intel
Streaming <Kommunikationstechnik>
Last
Kontrollstruktur
Punkt
Softwaretest
Addition
Kraftfahrzeugmechatroniker
Schreiben <Datenverarbeitung>
Dicke
Ausnahmebehandlung
Marketinginformationssystem
Entscheidungstheorie
Menge
Rechter Winkel
Konditionszahl
Festspeicher
Ablöseblase
Rechenwerk
Subtraktion
Folge <Mathematik>
Patch <Software>
Mathematische Logik
Überlagerung <Mathematik>
Demoszene <Programmierung>
Informationsmodellierung
Variable
Pufferspeicher
Netzbetriebssystem
Virtuelle Realität
Inhalt <Mathematik>
Gruppoid
Datenstruktur
Maßerweiterung
Drei
Rechenzeit
Komplex <Algebra>
Digitaltechnik
Gamecontroller
Wort <Informatik>
Abstimmung <Frequenz>
Punkt
Prozess <Physik>
Reihenfolgeproblem
Adressraum
Gruppenkeim
Computer
Komplex <Algebra>
Inzidenzalgebra
Kernel <Informatik>
Übergang
Einheit <Mathematik>
Kryptologie
Druckertreiber
Serviceorientierte Architektur
Folge <Mathematik>
Konstruktor <Informatik>
Parametersystem
Statistik
Quellcode
Ein-Ausgabe
Dateiformat
Algorithmische Programmiersprache
FLOPS <Informatik>
Datenfeld
Magnetkarte
ATM
URL
Decodierung
Information
Zentraleinheit
Aggregatzustand
Ortsoperator
Quader
Ausnahmebehandlung
Physikalismus
Zahlenbereich
Vektorraum
Programmschema
Zentraleinheit
Code
Division
Puffer <Netzplantechnik>
Adressraum
Optimierung
Speicher <Informatik>
Fehlermeldung
Elektronische Publikation
Matching <Graphentheorie>
Relativitätstheorie
Vektorraum
Physikalisches System
Office-Paket
Integral
Arithmetisch-logische Einheit
Druckertreiber
Pufferüberlauf
Mereologie
Speicherabzug
Computerarchitektur
Kernel <Informatik>
Server
Punkt
Prozess <Physik>
Kontrollstruktur
Hecke-Operator
Mathematisierung
Geräusch
Rechnernetz
Physikalisches System
Computerunterstütztes Verfahren
Dateiformat
Framework <Informatik>
Internetworking
Knotenmenge
Softwaretest
Framework <Informatik>
Mustersprache
Softwareentwickler
Druckertreiber
Programmierumgebung
Zentraleinheit
Impuls
Stereometrie
Bit
Punkt
Blackbox
Compiler
Adressraum
Selbstrepräsentation
Orakel <Informatik>
Aggregatzustand
Benutzerfreundlichkeit
Gesetz <Physik>
Analysis
Randomisierung
Schlussfolgern
Funktion <Mathematik>
Softwaretest
Nichtlinearer Operator
Konstruktor <Informatik>
Dicke
Sichtenkonzept
Reverse Engineering
Datenhaltung
Digitalfilter
Ein-Ausgabe
Rechenschieber
Dienst <Informatik>
Datenfeld
Funktion <Mathematik>
Datenstruktur
Framework <Informatik>
Menge
Rechter Winkel
Ein-Ausgabe
Ablöseblase
URL
Aggregatzustand
Zeichenkette
Subtraktion
Mathematische Logik
Decodierung
Wellenpaket
Mathematisierung
Geräusch
Systemzusammenbruch
Zentraleinheit
Mathematische Logik
Term
Informationsmodellierung
Irrfahrtsproblem
Luenberger-Beobachter
Gruppoid
Datenstruktur
Analysis
Matching <Graphentheorie>
Befehlscode
Datenmodell
Mailing-Liste
Paarvergleich
Gerade
Quick-Sort
Coprozessor
Mapping <Computergraphik>
Flächeninhalt
Hypermedia
Gamecontroller
Normalvektor
Orakel <Informatik>
Mapping <Computergraphik>
Informationsmodellierung
Bit
Minimalgrad
Flächeninhalt
Rechter Winkel
Flächentheorie
Mustersprache
Zellularer Automat
Projektive Ebene
Zentraleinheit
Trojanisches Pferd <Informatik>
Bit
Punkt
Prozess <Physik>
Hochdruck
Formale Sprache
Versionsverwaltung
Computer
Gesetz <Physik>
Formale Semantik
Streaming <Kommunikationstechnik>
Wechselsprung
Umkehrung <Mathematik>
Reverse Engineering
Emulator
Erweiterte Realität <Informatik>
Verschiebungsoperator
Metropolitan area network
Folge <Mathematik>
Lineares Funktional
Konstruktor <Informatik>
Nichtlinearer Operator
Statistik
Vervollständigung <Mathematik>
Abstraktionsebene
Kryptologie
Stichprobe
Wurm <Informatik>
Systemaufruf
Trojanisches Pferd <Informatik>
Ein-Ausgabe
Konstante
Wechselsprung
Konditionszahl
Festspeicher
Decodierung
Aggregatzustand
Geschwindigkeit
Folge <Mathematik>
Mathematische Logik
Kontrollstruktur
Spyware
Implementierung
Zentraleinheit
Symmetrische Matrix
Framework <Informatik>
Division
Code
Mailing-Liste
Bildschirmmaske
Stichprobenumfang
COM
Primitive <Informatik>
Datenstruktur
Maßerweiterung
Optimierung
Speicher <Informatik>
Drei
Gammafunktion
Implementierung
Drucksondierung
Matching <Graphentheorie>
Drei
Selbstorganisierende Karte
Division
POKE
Browser
Verzweigendes Programm
Vektorraum
Physikalisches System
Modul
Office-Paket
Mapping <Computergraphik>
System F
Vorwärtsfehlerkorrektur
Normalvektor
Konstante
Energiedichte
Informationsmodellierung
Datenfeld
Menge
Gamecontroller
Gruppenkeim
Vektorraum
Euler-Winkel
Ordnung <Mathematik>
Analytische Fortsetzung
Code
Metropolitan area network
Energiedichte
Codierung
Variable
Bildgebendes Verfahren
Funktion <Mathematik>
Prozess <Informatik>
Adressraum
Relativitätstheorie
Programmverifikation
COM
Elektronische Unterschrift
Fokalpunkt
Lie-Gruppe
Standardabweichung
Konstruktor <Informatik>
Termersetzungssystem
Mathematisierung
Gruppenkeim
Zentraleinheit
E-Mail
Knotenmenge
Serielle Schnittstelle
Gamecontroller
Wurzel <Mathematik>
URL
Programmbibliothek
Optimierung
Bit
Graph
Rechnen
Kontextbezogenes System
Fehlermeldung
Einfügungsdämpfung
Momentenproblem
Orakel <Informatik>
Raum-Zeit
Rechenbuch
Homepage
Streaming <Kommunikationstechnik>
Gruppe <Mathematik>
Translation <Mathematik>
Computersicherheit
Kontrollstruktur
Softwaretest
Kraftfahrzeugmechatroniker
Sichtenkonzept
Reverse Engineering
Computersicherheit
Winkel
Stichprobe
Digitalfilter
Kontextbezogenes System
Mechanismus-Design-Theorie
Konstante
Menge
Rechter Winkel
Ein-Ausgabe
Ordnung <Mathematik>
Fehlermeldung
Folge <Mathematik>
RISC
Klasse <Mathematik>
Variable
Informationsmodellierung
Bildschirmmaske
Inhalt <Mathematik>
Abstand
Datenstruktur
Maßerweiterung
Attributierte Grammatik
Demo <Programm>
Videospiel
Datenmodell
Programmverifikation
Unendlichkeit
Patch <Software>
Lie-Gruppe
Resultante
Bit
Prozess <Physik>
Punkt
Adressraum
Computer
Binärcode
Analysis
Internetworking
Eins
Arithmetischer Ausdruck
Einheit <Mathematik>
Regulärer Graph
Kryptologie
Minimum
Schlussfolgern
Flächeninhalt
Nichtlinearer Operator
Konstruktor <Informatik>
Kryptologie
Systemaufruf
p-Block
Quellcode
Ein-Ausgabe
Dialekt
Softwarewartung
Datenstruktur
Twitter <Softwareplattform>
Garbentheorie
Decodierung
Message-Passing
Zentraleinheit
Beweistheorie
Rückkopplung
Total <Mathematik>
Zahlenbereich
Zentraleinheit
Framework <Informatik>
Code
Elektronische Unterschrift
Stichprobenumfang
Jensen-Maß
Coprozessor
Touchscreen
Schreib-Lese-Kopf
Implementierung
Hardware
Binärcode
Fehlermeldung
Matching <Graphentheorie>
Physikalisches System
Quick-Sort
Mapping <Computergraphik>
System F
Mereologie
Basisvektor
Computerarchitektur
Hypermedia
Medianwert
Systemprogrammierung
Computerunterstützte Übersetzung

Metadaten

Formale Metadaten

Titel Everything you want to know about x86 microcode, but might have been afraid to ask
Untertitel An introduction into reverse-engineering x86 microcode and writing it yourself
Serientitel 34th Chaos Communication Congress
Autor Kollenda, Benjamin
Koppe, Philipp
Lizenz CC-Namensnennung 4.0 International:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
DOI 10.5446/34853
Herausgeber Chaos Computer Club e.V.
Erscheinungsjahr 2017
Sprache Englisch

Inhaltliche Metadaten

Fachgebiet Informatik
Abstract Microcode is an abstraction layer on top of the physical components of a CPU and present in most general-purpose CPUs today. While it is well-known that CPUs feature a microcode update mechanism, very little is known about its inner workings given that microcode and the update mechanism itself are proprietary and have not been throughly analyzed yet. We close this gap by both analyzing microcode and writing our own programs for it. This talk will give an insight into our results and how we achieved them, including live demos of what we can do and technical details.
Schlagwörter Security

Zugehöriges Material

Video wird in der folgenden Ressource zitiert

Ähnliche Filme

Loading...
Feedback