4 ms·
This is pretty much the same process we went though to reverse engineer the custom "VPU" instruction set for the co-processor that the Raspberry Pi's firmware r
by phire 7y ago
This is pretty much the same process we went though to reverse engineer the custom "VPU" instruction set for the co-processor that the Raspberry Pi's firmware runs on.
We used the publicly available bootcode.bin and loader.bin to RE most of the ISA before the Pis even started shipping, though there were some more obscure instructions that we weren't sure about until we could run our own code.
But when my pi did arrive, we knew enough to write a binary that would blink an LED on more-or-less the first attempt.
I guess the real lesson, custom ISAs are not a good form of security.
- dymk 7y agoThey're not supposed to be for security, they're to serve a specific functional purpose.
- NotSammyHagar 7y agoWhat's that purpose then for a secret instruction set?
- mnd999 7y agoProbably so they can change it at will without having to worry about breaking other people’s code.
- londons_explore 7y agoCompanies either want to be earning money from an API, or they want to keep it secret. An internal API which people reverse engineer and use is just going to lead to hassles later when you want to change the API, when people start writing bots or abuse the API in ways you hadn't imagined, or expose bugs in the API the official client didn't.
- Someone 7y agoI haven’t heard it about CPUs, but worries about patents also could be part of the reason. That is/used to be a fairly common argument as to why GPU makers do not release hardware specs.
- autoexec 7y agoIs that because they know they are violating other people's patents and don't want to be caught or just that the patent system is such a nightmare that even though they didn't intentionally do it something they've done is probably infringing on another company's patents?
- monocasa 7y agoYes.
- moftz 7y agoVendor lock-in for their IDE/toolchain. If the ISA isn't open, you're going to be paying the vendor for a license to compile new code.
- earenndil 7y agoSecurity by obscurity is, in general, not a great idea.
- SomeOldThrow 7y agoDepends on your needs and the threat profile.
- Someone 7y agoI think that depends on how far you’re willing to go. For example, it doesn’t take many transistors to XOR every instruction byte with the least significant byte of the address it is read from before sending it to the CPU proper. And that’s just the easy first version. XOR with a hash of the address, swap bits across entire cache lines when loading each cache line in the instruction cache, etc. Such mechanisms even would be fairly secure if the attacker has access to the machine code of a JITter. The attacker would have to crack the encryption to understand what the JITter does.