domas
@xoreaxeaxeax
I've escaped containment.
hacker math & stuff: movfuscator, sandsifter, project:rosenbridge, ..cantor.dust.., REpsych, memory sinkhole; more mistakes pending.
72 Following 12.3K Followers
Performance analysis of regular compilation against replacing the entire ISA with one instruction.
Results are not favorable.
This is what happens when a CPU has forty-eight years of never removing anything
Resurrecting abandoned experiments in reverse engineering:
hexcymatix: find something of interest – structures, packets, payloads – and substring analysis finds the similar data for you.
Doesn't work well. Looks cool though.
Show more
New primitive against x86's shadiest mode:
SMM has a critical barrier forcing cores to sync before running privileged code. Conveniently, the barrier has a timeout, which breaks for the funniest possible reason.
Pointlessly flashy GUI for effect.
Show more
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
Show more
Here’s an unassuming tool I’ve been sitting on for a decade.
Measure address latency, and timing leaks hardware structure.
Unexpectedly useful for reverse-engineering, fingerprinting, side-channels, malicious triggers, killer pokes, etc.
mmiotic:
Show more
Everyone's trying to make CPUs faster.
I’m trying to make them worse.
New project: CPU deoptimization.
Searching for the slowest possible machine instructions
x86 single instruction record:
198,002,498,236 cycles, 62 seconds
The assembly hall of shame:
Show more
Schrödinger’s TOCTOU — a bug class where a struct’s size mod 16 decides if you’re exploitable, where -O2 saves you and -O3 kills you, where a compiler upgrade introduces the bug, and a downgrade… introduces it too. Invisible, intractable, everywhere.
Show more
Been too long without releasing something that made me laugh… time to fix that.
GOD MODE UNLOCKED: hardware backdoors in some x86 CPUs
White paper coming tomorrow. @BlackHatEvents
So is branchless computation hardened against #spectre# and #meltdown#? Here's a secure, branchless DOOM ...
7 hours in, 1 frame rendered.
VIDEO: “Breaking the x86 Instruction Set” by @xoreaxeaxeax #BHUSA# 2017 Briefing presentation
sandsifter results: secret instructions; bugs in IDA, gdb, VS, valgrind, capstone, qemu; flaws in hypervisors; critical hardware locks; etc.
new project: sandsifter x86 processor fuzzer; exposes hidden instructions in x86;
I'll be demonstrating the first x86 'killer poke' instruction found in 20 years at #BHUSA# next week; processor DoS from ring 3
copy/paste/search/replace are turing-complete so, brainf@!# interpreter, in vanilla vim.
Hmm. All programs reduce to the same instruction stream. Left, AES; right, Minesweeper.
and the randomfuscator just randomly throws crap together: (HT
@angealbertini @f4grx)
and of course, the cmpxchgxchgfuscator...
