4 ms·

I don't believe Intel (whose implementation of encryption this targets) have an IOMMU for PCIe. For UPI (or whatever inter-socket protocol is going on), it woul

I don't believe Intel (whose implementation of encryption this targets) have an IOMMU for PCIe. For UPI (or whatever inter-socket protocol is going on), it wouldn't make sense to have an IOMMU since cores need permission to do arbitrary reads anyway.

amluto 8y ago
Intel has an IOMMU for PCIe. And DMA sees cleartext with (MK)TME.
- Flow 8y ago
  There are hardware based cheats for CSGO. It’s a PCI card with some custom CPU/FPGA on it that scans and changes values inside the memory of the game. When I read the title I hoped it would protect against that too, but no such luck then, I guess?
  - blattimwind 8y ago
    TBH if you have to resort to bus-based cheating in a game then I'd say it counts as a win for the anti-cheat software.
    - Flow 8y ago
      There are plenty of cheats that are seemingly impossible to detect. I play Team Fortress 2 and there's at least one cheat there that, from what I've read, uses code that's unique to each instance used by a cheater. VAC seems to scan for code signatures so it doesn't detect it. This hardware cheat makes it even harder to detect since it reads and writes directly to main memory using DMA. No drivers or software needed at all. All you possibly could detect is the PCI-ID(which can be changed) and possibly the DMA if there's an IOMMU. https://blog.esea.net/esea-hardware-cheats/ https://blog.esea.net/esea-hardware-cheats/
- posix_me_less 8y ago
  > And DMA sees cleartext with (MK)TME. Could you please translate this into non-expert language? Does it mean DMA granted devices can break IOMMU separation?
  - amluto 8y ago
    No, I mean that, if the IOMMU is off or if it allows access to an address, then MKTME will treat that access exactly as though it was a normal access from the CPU. So, if the device selects the right key (the key uses some otherwise unused physical address bits), then the device will access the decrypted data.
monocasa 8y ago
VT-d is an IOMMU for PCIe.

amluto 8y ago

Intel has an IOMMU for PCIe. And DMA sees cleartext with (MK)TME.

Flow 8y ago
There are hardware based cheats for CSGO. It’s a PCI card with some custom CPU/FPGA on it that scans and changes values inside the memory of the game. When I read the title I hoped it would protect against that too, but no such luck then, I guess?
- blattimwind 8y ago
  TBH if you have to resort to bus-based cheating in a game then I'd say it counts as a win for the anti-cheat software.
  - Flow 8y ago
    There are plenty of cheats that are seemingly impossible to detect. I play Team Fortress 2 and there's at least one cheat there that, from what I've read, uses code that's unique to each instance used by a cheater. VAC seems to scan for code signatures so it doesn't detect it. This hardware cheat makes it even harder to detect since it reads and writes directly to main memory using DMA. No drivers or software needed at all. All you possibly could detect is the PCI-ID(which can be changed) and possibly the DMA if there's an IOMMU. https://blog.esea.net/esea-hardware-cheats/ https://blog.esea.net/esea-hardware-cheats/
posix_me_less 8y ago
> And DMA sees cleartext with (MK)TME. Could you please translate this into non-expert language? Does it mean DMA granted devices can break IOMMU separation?
- amluto 8y ago
  No, I mean that, if the IOMMU is off or if it allows access to an address, then MKTME will treat that access exactly as though it was a normal access from the CPU. So, if the device selects the right key (the key uses some otherwise unused physical address bits), then the device will access the decrypted data.

monocasa 8y ago

VT-d is an IOMMU for PCIe.