4 ms·

A modern CPU has a transistor count in the billions/low tens of billions. I haven't really thought about it but I'm tempted to say that looking at the decoder s

by alxlaz 7y ago

A modern CPU has a transistor count in the billions/low tens of billions. I haven't really thought about it but I'm tempted to say that looking at the decoder stage(s) alone won't do. Undocumented operation doesn't have to be in the form of an entire undocumented instruction. You could design the device so that the "right thing" would happen simply by scheduling the right instruction, with the right arguments, under the right conditions (the right execution unit, the right amount of pipeline clog etc.). The whole thing is significantly more complex than the "fetch-decode-execute" diagrams would have you believe -- execution isn't strictly sequential, executing exactly the same instruction won't cause the exact same transistors to "fire" each time etc.. So the level of complexity is pretty daunting. IMHO if you want to find out undocumented behaviour that was deliberately introduced, you're better off looking at other methods, no matter how deep your pockets are.

dmitrygr 7y ago
> A modern CPU has a transistor count in the billions/low tens of billions A large percentage of that is simply 6T/cell SRAM L1/L2/etc cache though
- alxlaz 7y ago
  Certainly. But even those can be routed so that the WR signal for a particular address also doubles as half of the AND input which causes a read from another range to always return zero, for example. (That's not an "undocumented opcode", of course, but it can be used maliciously). It's certainly not easy to do this kind of meaningful obfuscation though, especially between different blocks, since different blocks are usually in different clock domains, too. Edit: sorry, my neurons got all jumbled and I was thinking of a far more general case, i.e. undocumented behaviour in general, not just undocumented instructions. Indeed, only a relatively small subset of all these transistors is relevant in terms of undocumented instructions specifically.

by alxlaz 7y ago

dmitrygr 7y ago

> A modern CPU has a transistor count in the billions/low tens of billions A large percentage of that is simply 6T/cell SRAM L1/L2/etc cache though

alxlaz 7y ago
Certainly. But even those can be routed so that the WR signal for a particular address also doubles as half of the AND input which causes a read from another range to always return zero, for example. (That's not an "undocumented opcode", of course, but it can be used maliciously). It's certainly not easy to do this kind of meaningful obfuscation though, especially between different blocks, since different blocks are usually in different clock domains, too. Edit: sorry, my neurons got all jumbled and I was thinking of a far more general case, i.e. undocumented behaviour in general, not just undocumented instructions. Indeed, only a relatively small subset of all these transistors is relevant in terms of undocumented instructions specifically.