3 ms·
At minute 39:30, the lecturer demonstrates a snippet of HDL which will transition the CPU to ring 0 if a very specific instruction is passed to the processor co
by Cieplak 11y ago
At minute 39:30, the lecturer demonstrates a snippet of HDL which will transition the CPU to ring 0 if a very specific instruction is passed to the processor core:
https://www.youtube.com/watch?v=fwyh3Vychj8 https://www.youtube.com/watch?v=fwyh3Vychj8
- thesz 11y agoBTW, this kind of backdoor would be very visible in Bluespec. Bluespec is very concerned about resource use and you will have to make extra effort to bring (really unneeded) resources to be accessible during interesting stages of CPU pipeline.
- Cieplak 11y agoAbsolutely true, if you have the source code, which is trade secret. Correct me if I'm wrong, but Bluespec is like Haskell that compiles to Verilog? Seems pretty neat. Any such thing as circuit decompilers? In my imagination, they look like as huge boxes with tunneling electron microscopes inside, where you input a chip and it outputs source code.
- joshvm 11y agoThe closest I've seen to that are the guys that reverse engineered a 6502 at the transistor level and built a "perfect" emulator for it. http://www.visual6502.org/ http://www.visual6502.org/ I think even with modern computer vision techniques, it would be very very difficult to do this kind of thing automatically. If you were a big state with cheap labour, you could probably hire a load of people to do nothing but map traces all day.
- Cieplak 11y ago@joshvm looks like we ran out of thread depth.. That's super cool. I wanted to show you this too if you hadn't seen it already: http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-reverse-engineering http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-r...
- CamperBob2 11y agoThat is extremely neat. I wouldn't have thought you could build an 8080 in less than 1K lines of Verilog.