4 ms·
Exploiting DRAM bitflips to get a root shell
- sans_souse 2y agoThis is some low level hacking right here
- deleted 2y ago[deleted]
- backspace_ 2y agoDo I need a lighter or the matrix soundtrack to accomplish this hack.
- karmakaze 2y agoEither. [0] https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994 https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=10...
- ano-ther 2y agoImpressive! And a music track like that should be standard for all progress bars.
- dan_linder 2y agoSo if we don't have the addition of the antenna wire, is the usual case shielding sufficient or do we just need larger/intense pulses, more of them, or somewhere in between? is like to try this at home, but not if I have to solder a wire on the already small RAM traces.
- yonatan8070 2y agoIf you try it on a desktop system, the RAM is likely going to be in through-hole DIMM slots, so the soldering will be a lot more managable than in a laptop
- wrs 2y agoI’m not sure how you would limit the incoming interference to a single bit, unless you’re very good at beam forming antennas.
- CTDOCodebases 2y agoI remember kids using these things into Street Fighter II machines to get free credits.
- azalemeth 2y agoYet again, I wish we all had ECC ram! Here's the code: https://github.com/DavidBuchanan314/dram_emfi/blob/main/linux_x86_64_lpe.c https://github.com/DavidBuchanan314/dram_emfi/blob/main/linu... -- the basic idea is > Hardware setup: This time I put the "antenna" wire on DQ25, which will fault 64-bit values to +/-32MiB > Exploit strat: We fill up as much of physical memory as possible with page tables. > When we fault a PTE read, we have a good chance of landing on a page table, giving us R/W access to a page table from userspace.
- mikewarot 2y ago<rant value="verbose"> It's circuit bending, or Fritzing, not finding a clever exploit in DRAM. Even an ECC module isn't going to help you if it's on the CPU data bus. I just hope we don't all end up suffering through yet another 50% slowdown in patches to the Kernel to avoid this nonsense because someone buys the BS and now it has to be "fixed", like the row hammer software fixes, instead of just fixing the dam DRAM modules, and better hardware. </rant> Another analogy: It's like when a brain surgeon probes your cerebellum and suddenly you smell strawberry or hear Brahms. The surgeon certainly doesn't know what reaction you have unless you tell them. You wouldn't go around later saying "Dr Jones made me smell strawberries, on a whim, certainly he's a G*d"
- nwah1 2y agoIf there is no unpredictable ASLR then in this case it is as if the surgeon knows exactly where to probe to make you smell strawberries.
- saagarjha 2y agoYour analogy isn't quite right. It's as if the doctor is capable of turning your entire brain into strawberry-sensing neurons, and then they poke it and 90% of the time you think about strawberries.
- captn3m0 2y agoSome context from the author’s fedi account: > I'm exploring this because I think it might be useful for console hacking - where you have physical access, and the ability to execute sandboxed code (say, inside a web browser) ID: @retr0id@retr0.id (they ask not to link to their fedi instance).