4 ms·

I question the legality of this post: I'm pretty sure the Intel microcode specification is proprietary. While it's hard to say with certainty since Intel makes

I question the legality of this post: I'm pretty sure the Intel microcode specification is proprietary. While it's hard to say with certainty since Intel makes their website as hard to navigate as humanly possible, I doubt they'd hand over their secret sauce to competitors. On one hand, the subject of microcode would benefit from more transparency. Indeed, there are papers describing microcode behavior (Citadel's gpu papers come to mind). With that said, I'm concerned that the authors are more interested in exploits, given they have a disassembler repo. While a disassembler alone doesn't warrant concern (microcode is very specific to hardware), it is concerning if their presentation's claim is true; that is, the whole Atom line has similar microcode. I hope I'm wrong. I'm by no means an expert, but the sanctions leave me uneasy lol.

kbenson 5y ago
I'm not sure what you think is illegal about this. I suspect I'm either I'm coming at it from the wrong context, or I'm lacking in some info to fill in the gaps to make me think the same, as otherwise reverse engineering a processor is well tread (and legally supported) ground to my knowledge
- deleted 5y ago
  [deleted]
- kevin_thibedeau 5y ago
  The problem is that they attained this by decrypting the microcode. That runs afoul of DMCA circumvention rules unless it can fall under an exempt activity.
  - CogitoCogito 5y ago
    Does Russia fall under the DMCA? That's where the developers seem to be located.
    - kevin_thibedeau 5y ago
      Github's servers aren't in Russia.
      - no_time 5y ago
        Github takes down the repo -> authors host it in a country whose copyright laws are not written by billion dollar companies. I wish all russians a great day. Allowing this mentality to take a foothold in other parts of the world would be a major loss to humanity as a whole.
  - jacquesm 5y ago
    No, the problem is that the DMCA potentially makes decrypting microcode illegal.
woodruffw 5y ago
This looks like bog-standard "black box" reverse engineering, which is legal throughout the US and EU. The authors appear to be in Russia, where black box RE is also (probably) legal. But they have the added benefit of living under a government that doesn't particularly care about that anyways, as long as the target isn't a domestic one.
Terry_Roll 5y ago
Would you consider this to be illegal as well? https://www.researchgate.net/profile/Nikola-Zlatanov/publication/295010710_Booting_an_Intel_System_Architecture/links/56c659fa08ae0d3b1b603e91/Booting-an-Intel-System-Architecture.pdf https://www.researchgate.net/profile/Nikola-Zlatanov/publica... "Microcode Update. Microcode is a hardware layer of instructions involved in the implementation of the machine-defined architecture. It is most prevalent in CISC-based processors. Microcode is developed by the CPU7 vendor and incorporated into an internal CPU ROM during manufacture. Since the infamous “Pentium flaw,” Intel processor architecture allows that microcode to be updated in the field either through a BIOS update or via an OS update of “configuration data.” Today an Intel processor must have the latest microcode update to be considered a warranted CPU. Intel provides microcode updates that are written to the writable microcode store in the CPU. The updates are encrypted and signed by Intel such that only the processor that the microcode update was designed for can authenticate and load that update. On socketed systems, the BIOS may have to carry many flavors of microcode update depending on the number of processor steppings supported. It is important to load the microcode updates early in the boot sequence to limit the exposure of the system to any known errata in the silicon. It is important to note that the microcode update may need to be reapplied to the CPU after certain reset events in the boot sequence. The BSP microcode update must be loaded before No-Eviction mode is entered." There is also this walkthrough https://igor-blue.github.io/2021/02/04/secure-boot.html https://igor-blue.github.io/2021/02/04/secure-boot.html And here in the EU some sorts of reverse engineering is legal which will include microcode, but interpretation of law is a minefield in its own right, because no one can tell what mood a Judge or Judges might be in on decision day! https://www.vidstromlabs.com/blog/the-legal-boundaries-of-reverse-engineering-in-the-eu/ https://www.vidstromlabs.com/blog/the-legal-boundaries-of-re...

kbenson 5y ago

I'm not sure what you think is illegal about this. I suspect I'm either I'm coming at it from the wrong context, or I'm lacking in some info to fill in the gaps to make me think the same, as otherwise reverse engineering a processor is well tread (and legally supported) ground to my knowledge

deleted 5y ago
[deleted]
kevin_thibedeau 5y ago
The problem is that they attained this by decrypting the microcode. That runs afoul of DMCA circumvention rules unless it can fall under an exempt activity.
- CogitoCogito 5y ago
  Does Russia fall under the DMCA? That's where the developers seem to be located.
  - kevin_thibedeau 5y ago
    Github's servers aren't in Russia.
    - no_time 5y ago
      Github takes down the repo -> authors host it in a country whose copyright laws are not written by billion dollar companies. I wish all russians a great day. Allowing this mentality to take a foothold in other parts of the world would be a major loss to humanity as a whole.
- jacquesm 5y ago
  No, the problem is that the DMCA potentially makes decrypting microcode illegal.

woodruffw 5y ago

This looks like bog-standard "black box" reverse engineering, which is legal throughout the US and EU. The authors appear to be in Russia, where black box RE is also (probably) legal. But they have the added benefit of living under a government that doesn't particularly care about that anyways, as long as the target isn't a domestic one.

Terry_Roll 5y ago

Would you consider this to be illegal as well? https://www.researchgate.net/profile/Nikola-Zlatanov/publication/295010710_Booting_an_Intel_System_Architecture/links/56c659fa08ae0d3b1b603e91/Booting-an-Intel-System-Architecture.pdf https://www.researchgate.net/profile/Nikola-Zlatanov/publica... "Microcode Update. Microcode is a hardware layer of instructions involved in the implementation of the machine-defined architecture. It is most prevalent in CISC-based processors. Microcode is developed by the CPU7 vendor and incorporated into an internal CPU ROM during manufacture. Since the infamous “Pentium flaw,” Intel processor architecture allows that microcode to be updated in the field either through a BIOS update or via an OS update of “configuration data.” Today an Intel processor must have the latest microcode update to be considered a warranted CPU. Intel provides microcode updates that are written to the writable microcode store in the CPU. The updates are encrypted and signed by Intel such that only the processor that the microcode update was designed for can authenticate and load that update. On socketed systems, the BIOS may have to carry many flavors of microcode update depending on the number of processor steppings supported. It is important to load the microcode updates early in the boot sequence to limit the exposure of the system to any known errata in the silicon. It is important to note that the microcode update may need to be reapplied to the CPU after certain reset events in the boot sequence. The BSP microcode update must be loaded before No-Eviction mode is entered." There is also this walkthrough https://igor-blue.github.io/2021/02/04/secure-boot.html https://igor-blue.github.io/2021/02/04/secure-boot.html And here in the EU some sorts of reverse engineering is legal which will include microcode, but interpretation of law is a minefield in its own right, because no one can tell what mood a Judge or Judges might be in on decision day! https://www.vidstromlabs.com/blog/the-legal-boundaries-of-reverse-engineering-in-the-eu/ https://www.vidstromlabs.com/blog/the-legal-boundaries-of-re...