4 ms·

Did I misread? I thought it only requires userland?

• 3JPLW 11y ago
  The presentation certainly makes it seem that way. The dramatic "POC" with the magic number only works with the rootkit already installed. The proceedings paper has much more detail[1]. Installing the rootkit requires some very careful crafting and requires ring 0 to request memory remapping and set up far pointer descriptors. 1. (pdf) https://www.blackhat.com/docs/us-15/materials/us-15-Domas-The-Memory-Sinkhole-Unleashing-An-x86-Design-Flaw-Allowing-Universal-Privilege-Escalation-wp.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Domas-Th...
• TazeTSchnitzel 11y ago
  You didn't read past the first page. The only userland thing is activating the rootkit.