4 ms·

> successfully tested Could you elaborate on this? What device did you test on, what was the test procedure, and what was the outcome?

by Retr0id 4mo ago

liffik 4mo ago
Sure! The testing was conducted on a specific industrial x86 board (DPX-W250 Rev. A1). I won't go into details about the exact equipment it came from, but it provided a perfect bare-metal environment for this research)))) The testing procedure was a classic physical Cold Boot Attack: Froze the RAM modules while the target system was fully operational. Performed a hard power-off. Quickly swapped the original system drive with my own prepared drive containing the BareMetal-RAM-Dumper. Powered the system back on and booted directly into the custom bootloader via Legacy BIOS. The result: Absolutely successful. The dumper immediately took control, switched to Unreal Mode, and successfully dumped the raw physical memory directly to the disk without any OS interference or data trampling. P.S. I'm using AI to translate my messages because I don't speak English. Hope everything is clear!
ranger_danger 4mo ago
Not the author, but this is an extremely simple tool that is not written with any device-specific code... it should work on most any x86-based PC device (plain BIOS or a UEFI system with CSM support enabled).
- liffik 4mo ago
  Right
- Retr0id 4mo ago
  The code in the repo is trivial, that's not really what I was referring to. Getting DRAM cooled and swapped from one system to another is nontrivial, and I assumed most hardware/firmware zeroed memory on boot (to prevent being used to cold-boot-attack itself, without even needing a ln2-cooled board swap.) Those are the interesting aspects, not the code!
  - liffik 4mo ago
    Ah, I see what you mean! You are totally right, the physical execution is the truly interesting part. To clarify, I actually didn't swap the RAM modules to another system. Moving cooled RAM is incredibly difficult and leads to rapid data decay. Instead, I left the frozen RAM exactly where it was on the original board. After the hard power-off, I just quickly swapped the system drive for my prepared drive and booted the same machine back up. Regarding memory zeroing on boot: that is a highly relevant point. Modern systems (especially with TCG MOR enabled) try to scrub memory during POST to prevent exactly this. However, two things help here: Fast Boot / Board Specifics: Many BIOSes, including the one on the industrial board I tested (DPX-W250), skip full memory checks and zeroing to speed up boot times. Hard Power-Off: By cutting power abruptly, the OS doesn't get a chance to set any "clean shutdown" flags. Upon reboot, the BIOS just did a quick POST and handed control to my 16-bit bootloader via CSM, leaving the frozen memory completely intact. P.S. I'm using AI to translate my messages because I don't speak English. Hope this explains the physics of the attack!
  - dlcarrier 4mo ago
    Zeroing memory on boot is pretty slow. Modern CPUs support encrypting the RAM with a key generated at boot and lost when the processor powers off. This would give even better security under most circumstances, without the slow boot.
    - alfiedotwtf 4mo ago
      Wow, that sounds quite slow? I wonder what speed boosts you could get if you disable this if this is not an attack vector you want to cover
      - dlcarrier 4mo ago
        It's done transparently in hardware, so it doesn't slow down the RAM.
        Retr0id 4mo ago

> successfully tested Could you elaborate on this? What device did you test on, what was the test procedure, and what was the outcome?

by Retr0id 4mo ago

> successfully tested Could you elaborate on this? What device did you test on, what was the test procedure, and what was the outcome?

liffik 4mo ago

Sure! The testing was conducted on a specific industrial x86 board (DPX-W250 Rev. A1). I won't go into details about the exact equipment it came from, but it provided a perfect bare-metal environment for this research)))) The testing procedure was a classic physical Cold Boot Attack: Froze the RAM modules while the target system was fully operational. Performed a hard power-off. Quickly swapped the original system drive with my own prepared drive containing the BareMetal-RAM-Dumper. Powered the system back on and booted directly into the custom bootloader via Legacy BIOS. The result: Absolutely successful. The dumper immediately took control, switched to Unreal Mode, and successfully dumped the raw physical memory directly to the disk without any OS interference or data trampling. P.S. I'm using AI to translate my messages because I don't speak English. Hope everything is clear!

ranger_danger 4mo ago

Not the author, but this is an extremely simple tool that is not written with any device-specific code... it should work on most any x86-based PC device (plain BIOS or a UEFI system with CSM support enabled).

liffik 4mo ago
Right
Retr0id 4mo ago
The code in the repo is trivial, that's not really what I was referring to. Getting DRAM cooled and swapped from one system to another is nontrivial, and I assumed most hardware/firmware zeroed memory on boot (to prevent being used to cold-boot-attack itself, without even needing a ln2-cooled board swap.) Those are the interesting aspects, not the code!
- liffik 4mo ago
  Ah, I see what you mean! You are totally right, the physical execution is the truly interesting part. To clarify, I actually didn't swap the RAM modules to another system. Moving cooled RAM is incredibly difficult and leads to rapid data decay. Instead, I left the frozen RAM exactly where it was on the original board. After the hard power-off, I just quickly swapped the system drive for my prepared drive and booted the same machine back up. Regarding memory zeroing on boot: that is a highly relevant point. Modern systems (especially with TCG MOR enabled) try to scrub memory during POST to prevent exactly this. However, two things help here: Fast Boot / Board Specifics: Many BIOSes, including the one on the industrial board I tested (DPX-W250), skip full memory checks and zeroing to speed up boot times. Hard Power-Off: By cutting power abruptly, the OS doesn't get a chance to set any "clean shutdown" flags. Upon reboot, the BIOS just did a quick POST and handed control to my 16-bit bootloader via CSM, leaving the frozen memory completely intact. P.S. I'm using AI to translate my messages because I don't speak English. Hope this explains the physics of the attack!
- dlcarrier 4mo ago
  Zeroing memory on boot is pretty slow. Modern CPUs support encrypting the RAM with a key generated at boot and lost when the processor powers off. This would give even better security under most circumstances, without the slow boot.
  - alfiedotwtf 4mo ago
    Wow, that sounds quite slow? I wonder what speed boosts you could get if you disable this if this is not an attack vector you want to cover
    - dlcarrier 4mo ago
      It's done transparently in hardware, so it doesn't slow down the RAM.
      - Retr0id 4mo ago