Inside the AMD Microcode ROM

Video thumbnail (Frame 0) Video thumbnail (Frame 930) Video thumbnail (Frame 2009) Video thumbnail (Frame 5951) Video thumbnail (Frame 6976) Video thumbnail (Frame 10378) Video thumbnail (Frame 11981) Video thumbnail (Frame 12839) Video thumbnail (Frame 17147) Video thumbnail (Frame 19757) Video thumbnail (Frame 22512) Video thumbnail (Frame 25432) Video thumbnail (Frame 28156) Video thumbnail (Frame 36713) Video thumbnail (Frame 38045) Video thumbnail (Frame 41400) Video thumbnail (Frame 42432) Video thumbnail (Frame 44472) Video thumbnail (Frame 45839) Video thumbnail (Frame 48067) Video thumbnail (Frame 49049) Video thumbnail (Frame 51141) Video thumbnail (Frame 52577) Video thumbnail (Frame 53343) Video thumbnail (Frame 55162)
Video in TIB AV-Portal: Inside the AMD Microcode ROM

Formal Metadata

Title
Inside the AMD Microcode ROM
Subtitle
(Ab)Using AMD Microcode for fun and security
Title of Series
Author
License
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
2018
Language
English

Content Metadata

Subject Area
Abstract
Microcode runs in most modern CPUs and translates the outer instruction set (e.g. x86) into a simpler form (usually a RISC architecture). It is updatable to fix bugs in the silicon (see Meltdown/Spectre), but these updates are encrypted and signed, so no one knows how microcode works on conventional CPUs. We successfully reverse engineered part of the microde semantics of AMD CPUs and are able to write our own programs. We also recovered the mapping between the physical readout (electron microscope) and the "virtual" addresses used by microcode itself. In this talk we present background on microcode, our findings, our open source framework to write custom microcode and our custom defensive measures implemented in microcode.
Keywords Security

Related Material

Musical ensemble Semiconductor memory
Dataflow Focus (optics) Software Code Student's t-test Information security Computer font Information security Reverse engineering
Complex (psychology) Intel Patch (Unix) Port scanner Disk read-and-write head Code 2 (number) Prime ideal Architecture Crash (computing) Spherical cap Befehlsprozessor Military operation Vector space Bus (computing) System programming Exception handling Computer font Constructor (object-oriented programming) Complex (psychology) Bit Coprocessor Cartesian coordinate system Data management Ring (mathematics) Tower Crash (computing) Software framework Clique problem Exception handling Scheduling (computing) Asynchronous Transfer Mode Firmware Data buffer
Cue sports Classical physics Email Computer file Authentication Fatou-Menge Workstation <Musikinstrument> Virtual machine 3 (number) Device driver Online help Heat transfer Streaming media Surgery Formal language Sequence Word Universal product code Positional notation Different (Kate Ryan album) Computer configuration Kernel (computing) Military operation Vector space Oracle Condition number Pairwise comparison Point (geometry) Constructor (object-oriented programming) Data storage device Complete metric space Cache (computing) Data management Word Digital photography Software Chain Self-organization Musical ensemble Quicksort Data structure
Data recovery Content (media) Mathematical analysis Product (business) Word Data management Structured programming Process (computing) Computer hardware Military operation Operator (mathematics) Process (computing) God
Group action Code Texture mapping Workstation <Musikinstrument> Combinational logic Semantics (computer science) Neuroinformatik Sign (mathematics) Virtual reality Computer configuration Military operation Core dump Flag Electronic visual display Process (computing) Mapping Block (periodic table) Data recovery Quadrilateral Data storage device Bit Emulator Video game console Astrophysics Resultant Reverse engineering Spacetime Point (geometry) Asynchronous Transfer Mode Implementation Data recovery 3 (number) Operator (mathematics) Cartesian closed category System programming Implementation output Installable File System Operations research Matching (graph theory) Counting Core dump Semantics (computer science) Group action Uniform resource locator Software Logic programming Function (mathematics) Travelling salesman problem Blog Physicist Social class Address space Flag
Asynchronous Transfer Mode Ferry Corsten Multiplication sign Workstation <Musikinstrument> Combinational logic Cloud computing 3 (number) Open set Revision control Military operation Operator (mathematics) Cartesian closed category Endliche Modelltheorie Position operator Identity management Projective plane Stress (mechanics) Data storage device Group action Vector potential Subject indexing Personal digital assistant Social class Condition number Whiteboard Musical ensemble Spacetime Flag
Complex (psychology) Group action Latin square State of matter Java applet Multiplication sign Cloud computing Disk read-and-write head Mathematics Length of stay Benchmark Semiconductor memory Hypermedia Military operation Cuboid Extension (kinesiology) Logic gate Randomization Remote administration Namespace Building Software developer Constructor (object-oriented programming) Data storage device Bit Control flow Hand fan Connected space Data management Computer configuration Telecommunication Interface (computing) Acoustic shadow Software framework Condition number Software testing Right angle Lorenz curve Asynchronous Transfer Mode Asynchronous Transfer Mode Implementation Virtual machine 3 (number) Canonical ensemble Coprocessor 2 (number) Element (mathematics) Twitter Read-only memory Computer programming Operator (mathematics) Software Linear programming Authorization Cartesian closed category System programming Integrated development environment Software testing Implementation Traffic reporting Standard deviation Server (computing) Forcing (mathematics) Projective plane Content (media) Line (geometry) Group action Cartesian coordinate system Compiler Single-precision floating-point format Word Error message Software Motherboard Computer hardware Social class Musical ensemble Flag Address space
Befehlsprozessor Motherboard Computer hardware Telecommunication Workstation <Musikinstrument> Optics Integrated development environment Whiteboard Event horizon Power (physics) Scalability Power (physics)
Point (geometry) Vacuum Game controller Group action Wrapper (data mining) State of matter Assembly language Electronic program guide Content (media) Theory Computer programming Neuroinformatik Casting (performing arts) Structured programming Computer configuration Videoconferencing System programming OSI model Series (mathematics) Traffic reporting Disassembler Proof theory Serial port Software developer Computer program Electronic mailing list Code Bit Control flow Device driver Error message Order (biology) System programming Statement (computer science) Software framework Hydraulic motor Musical ensemble Information security Family Traffic reporting
Web page Mapping Multiplication sign Connectivity (graph theory) Perturbation theory Distance Compiler Uniform resource locator Software Video game Musical ensemble Acoustic shadow Pressure Extension (kinesiology)
Software Computer hardware Shared memory Machine vision
Causality Logistic distribution Multiplication sign Connectivity (graph theory) Single-precision floating-point format Musical ensemble Client (computing)
Data management Digital photography Goodness of fit 1 (number) Grass (card game) Public-key cryptography God
Complex (psychology) Data management Implementation Divisor Operator (mathematics) Statement (computer science) Computer programming
Game controller Service (economics) Software Code Constructor (object-oriented programming) Condition number Vector potential
Optics
Implementation Group action Connectivity (graph theory) Power (physics) Twitter Web 2.0 Data management Hypermedia Single-precision floating-point format Musical ensemble YouTube Exception handling Reverse engineering
Cartesian closed category Musical ensemble Semiconductor memory
[Music] the extra benjamin calendar and philipp wittrock works and more titles others
with sell benjamin is student focus and software
tax and defense got philip davies em the micro code for fun and security flow [Applause]
people eat like the reverse engineering the michael kothe and one gegentor built june what we did not work wismar colleague Jonas booking the war outline hood g??nter you sit here there is
like s creek crash course and micro cap ex or basic access the night talk about every contact to michael and his clique is on the course on applications be a bit quiet hand of second step relieve talk about you
babe and gitta belang is so to Continue okay so if and talk about my contacts inc often that people this we lead for sassenberg exception live handling obedient exception either that is true maltese for scans on motives and workflow ring destitute operating system powermanagement complex the update in sofia spectrometer and patches and updates texts steps to execute instruction extraction in two mode up Mahler micro ops 2 in front of the bus the codes of the runway most interesting and construction bank research institute in hand together the cosmetics or champions are growing salon the consistent someone's instructions and finally sector decoder the way the decoder phones complex instructions know head of marketing manager of micro tower is sitting that growth because of led only jnj instructions michael m So it's me with updates and up when you're a prime market update and of course the whole lot of things that make it actually ears rostock hero no
justice network is the outer band it is so far in adwords from the institut rom insight manager store if there is something execution controls transfer mft executed updates at oracle linux driver sometimes those updates Documents by michael kothe the loud inside secure micro of the organization of switzerland celebrated surgery extraction butt becomes
in the cache or insect protection Executed next as on options to execute in just are extra execute- ing another one by one thing to its watchers team ok one then is the construction Sixt ag was able to update Sixt as well as Kern chalk like canalys existing homes and the places to yours nevertheless laptop though very can only be update lode file if julia machines is update like picasso story you going to market president michael cohrs lucio was canceled transfer language added to the basics six months to cover the difference distributed the had to the michael kohlhaas can help streams from inception in comparison to classics with julia station mr. interesant border market has some sort with flex not so how z she is like the upc business intelligence for example there you in science fiction car updater carey flexdoors insight health inspection jesse will stop legally condition demolition industry stuck behind casey affleck is completely consumed in the chain of set to end user instruction see also so violently into words notations next complete m bronchoscopy note centers microsoft excel o2 uk 16 new gone to talk about how how managed to recover my photos pact interview the
content that any more we find island silicon.de production process inspection you think you want electron microscope also like that and content cities for operations manager she is peace concert out of four aces and blogs structures buffett again updating video layout update report into
cancer and other process how come yours the gadget as god into the 22 the corestate the penan siplace bath with vienna
trapping astrophysicist software that from zero to watch the ghost inside micro update truly reverse engineering we can yes studios there is the option one three quarter loud boat it was recovery usb treki the core 2 quad physicists will be whoever pairs asked yesterday it is concrete ip cores we seem to say you but apple updates petticoat without find two piece of summer special easy to find the update Replays is heard inside your trade door systems juli place you are with update so at matchings adwords it is an update places so far micro tom reach out of you just thought you'd be hard to get your data points as well generated mappings in matching semantics software interest micro vendor symantec become the fund execution of certain maico texas instruments of code the instruments are marco short in the late stage a trading update of the computer but has the body modified at Microsoft Exchange in toto blocks cross in blogs sms patients it is still fresh for this one know location exists different faces of the phoenix extraction of hurley experiments with ken loachs implementation on the facts for the simple living ship trouble witches
angelesouth the t??v s??d at result and a pen in bits from another rochester and corsi were expected inscription of his implementation and exactly what we've got here ship three top brands You can sixbreak him before displays or micro engine replay one bit combination swiss re store solutions xxx operation volks traffic light replaced by anyone jj in xxx it is Such a sweet destination is bad Systems will mount in the cold protected It's like we charge you to order the cost per Microtec is using the implementation sometimes we have something special sometimes apples patent space systems too shift count who our ship count and instruction station is a sign Developing a console is like that ticks on c x16 action rent updating the flag ski ok so let's go capital asset
is the models to returns internal accounter index atx is so laporte 1 but low in techno party like that incentives stooges the potential of their ship we have a very advisable june so heike counter returns to the beginning how have to co2 operations that want is the pilot with triathlon is on board the balloon instruction stargate resistance traction winterwind into it weekend for users doors open registers simplicity a reason is whether is identity player found out it's it's original storage essentials pacific internal register and we play or and until bed notice is with combination is recently fix that here in front Titan is an end find out cent it's bitter for the note Therme Lodge is fable from junos space and so it is now expert of our internal register how does actros is unfortunately from execution
who is spongetech south texas container fire dispute peter lucke picture it is and instruction actually updated stain like that the band was able to version 6.6 it for or not to the success of bath here as well as this exit tax ids case with it waits with this is what would expect the times the counter and now and then does on sat 1 at the counter tdx another station bad vino ok with something out of 26 becomes penniless Judith barth we still recourse here navi you know easy to europe should the tekken 6 is ines regret like coal do you know full idiot interested internal rochester julien cousineau protection ford interceptor the dino 246 stockbroker what the weather project for ladies night position in the of four chain-users whether they can something like so find immediate thought what were the masters instruction so implemented complicated
continues with the chili data management system virtual store and the fans with 40 ps between when doris 1 be involved It is non standard implementation Extensions for the complex features of xanten at update it gives minisex recognizes the easy access slaves have died in 64 bit so titan like as jesus on titan it that so that is a whole picture maersk is in zero zero bachelet the note namespace of pacific justice the specific namespace that you like flex and born for all your child bang the pending and 62 jbc dealers forces namespace ex-boxer she is the russian soprano namespace us so like bruce hendricks is like dispatch implemented correctly
okay so coach elements head of reconstruction are still playable how have to show you what we can access is a reason right hott applications middle may code the simple conficker autistic it is - until the end of the sword of the new york and reduced ecofit with whole times prevx and timing is Implemented it is some disappointment recover quickly in the second like autoherbst to basic micro instrumentation az - is youth leader filter before we we have in my concept so instead of cooking instruction instead of debugging yokohama let you can not just one ever since executed filter is system Comic is more relevant six dealers in tallinn micro is also a developer instruction in the interview as well implemented at the basica trend micro has updates news update complain the msv the Citro??n first place and in flight mode as well as found out are mostly action they have live live features because we execute in michael king and interviewer half-orphan content and any state certain tricks suddenly so microsoft word for micro can not be and for that against implementing is simple enclave on top of software.de texas by using the primary and change memory swell the latin rhythms the author software center will by the way in jacks but you sing instructions step by step in word access clocked it is generally very post-its under the porten word is important in essens is politically simple pilot rom is also a bit of a performance European sony is more often operations you just reporter bakker performance out of it because we sing instruction baby can do some fancy Tricks in Swansea bio since the father his news at six instructions reversed compact the software is implemented also sends during placing Slip and slip says that only young used by compiler speakers infect lorenz the lotus construction and in the village before this text is courageous 62 means the document is simons access to be so ban it's practically in unison until just like that is it tobias continues online happened over for the texas because of theke conficker projects like can for example which they say no with page4 weekend and which is custom and you are the processor like canon burn marks xxl so performance at the technical check against sex work listing report for you most important the single instruction like out now we have mid in the media intermediate know as june the gate itself Zambia 16 register as well as christopher Baby food billing solutions starts we also shutout for actually faster these are checking music six nations just because of the implementation of the 6 meik kottwitz in samba first kaindorf lay software java the cloth to performance and tops judith peter pakesch futuristic construction of glass and second, and valuable cash lines and testing program an interview just over for you on hamburg is going for houston development team united and updates and the skin makeshift as wanted to do so small cars tango is the people two mainboards is my motto just ob the mainboards for communication and jp bip you can bet on the town just remote control box is mainboard 11 connectivity from in los angeles the player and visitor since the beginning
like the geely know much about electronics as well as used on raspberry pi the world turns out raspberry pi some more expensive the sword wii improved demolition exactly we there and metro station barry
In the event of this, say setups folk
johann into the cpu mainboard you connect is the optics headless just the way you connect once optocoupler so since july reset to open air is in portimao board up and down you connect led consistently save the lord of scale out of you really Constant just the power led lenser because you know how is the setup it in my activities as raul castro
operating system of the international aluminum because they did not want you is control over and structures as Copy is an executed point because you play a bit of structure coating vacuum instruction set offers now intent like minecraft ipo like middle in the song state and video motives origins Option costs an angry birds is a Shield without list support for something to do what can do is apple an update she is update update austria series we can from austria xxx codemasters that's just like the theory meat so usb stick vital under update testing the eastern states could hessen michael semmler a quickie wider and michael bradley 25 hamburg like rewe touristik system-updates used to december song of the order and statement reporter sven greased tour guide develop from opera and ballet can be or linux and mature like woodstock from just not any update to Be wild until hecking is designed that protest in the body now also itself So still big stranger no controller grandchild remake casting is the implemented basic remote execution By the way, webworker motors advises local people
Mean and talk to the computer in the lead of updates and barcelona could be happy to share for working groups example programs implement to the altar flaig survivor and have so we have a lot wrong [Applause] [Music]
[Applause] [Music]
finally peter marko from swiss life of the prepress pressure builds york
where he has a distance like hubertus 1000 people is from wales and compiler extension instruction because there are currently exist in shadow maps like this instrument for location yellow pages to update and one time and just a genius to be like you have never been to Software ships hot component Center necessary so components
because historical hardware of the share vision software something new angeles new
[Music]
york times your single picture philips with can not slow down cause you know is it concerts ok maybe just do something So another baby, it is also have so for that the portal can since yet still win so as not looked at component British ecover client like Tony praised via website completely on electricity Now this one asks and logistics in Bad as well as nowotny looks like it is
Are you throwing Christian off the internet? grass signal to johnson city dallas the
amd positive is similar to single like the ones you think i betty ford us could have even thrown the manager 72 public key club biography design good god a photo story know-how
complex belongs to programs like bet you get right watch the complexity of new operations implementation factor is that update consolidate limited experiments limited it came and tricks the nation the statement constance instructions for example so next b executed the participants want to know how managers david loosli in utah is boxer konstanz were the toyota iq with
in food will actually execute in st.michael potential for fashion of what we understand why code engine is just some kind of software based rest the car is the construction way emphasizes eckert execution sce with instructions into the pipeline want because we have some control flea into a possibility that actually inside month we can bayern the future is you can condition jean-luc a deflated in execution button it in swisscom with stuff in the pipeline citizen service
chris hofberger here is access to take the solution optical shorts and t shirt the scanning electro microscope is 56
[Music] so what they document web is still very interested and also so media campaign because the beginning like reverse engineering certain exceptions in the trend micro to practice youtuber such no one built so homag group has endangered so high instruction set however some component microm since then oslo trigger at instructions for example of power management or everything that is behind continues vitamin is the single instruction bodypainting argued safe is implementation in marco dance is Yushchenko was next to enemy for outfit in front of a single commission for auction Of course, switch is great thanks to you
think you benjamin [Applause] [Music] [Music]
Feedback