6 ms·

Not the author, but this is an extremely simple tool that is not written with any device-specific code... it should work on most any x86-based PC device (plain

Not the author, but this is an extremely simple tool that is not written with any device-specific code... it should work on most any x86-based PC device (plain BIOS or a UEFI system with CSM support enabled).

liffik 4mo ago
Right
Retr0id 4mo ago
The code in the repo is trivial, that's not really what I was referring to. Getting DRAM cooled and swapped from one system to another is nontrivial, and I assumed most hardware/firmware zeroed memory on boot (to prevent being used to cold-boot-attack itself, without even needing a ln2-cooled board swap.) Those are the interesting aspects, not the code!
- liffik 4mo ago
  Ah, I see what you mean! You are totally right, the physical execution is the truly interesting part. To clarify, I actually didn't swap the RAM modules to another system. Moving cooled RAM is incredibly difficult and leads to rapid data decay. Instead, I left the frozen RAM exactly where it was on the original board. After the hard power-off, I just quickly swapped the system drive for my prepared drive and booted the same machine back up. Regarding memory zeroing on boot: that is a highly relevant point. Modern systems (especially with TCG MOR enabled) try to scrub memory during POST to prevent exactly this. However, two things help here: Fast Boot / Board Specifics: Many BIOSes, including the one on the industrial board I tested (DPX-W250), skip full memory checks and zeroing to speed up boot times. Hard Power-Off: By cutting power abruptly, the OS doesn't get a chance to set any "clean shutdown" flags. Upon reboot, the BIOS just did a quick POST and handed control to my 16-bit bootloader via CSM, leaving the frozen memory completely intact. P.S. I'm using AI to translate my messages because I don't speak English. Hope this explains the physics of the attack!
- dlcarrier 4mo ago
  Zeroing memory on boot is pretty slow. Modern CPUs support encrypting the RAM with a key generated at boot and lost when the processor powers off. This would give even better security under most circumstances, without the slow boot.
  - alfiedotwtf 4mo ago
    Wow, that sounds quite slow? I wonder what speed boosts you could get if you disable this if this is not an attack vector you want to cover
    - dlcarrier 4mo ago
      It's done transparently in hardware, so it doesn't slow down the RAM.
      - Retr0id 4mo ago
        It usually has a latency cost, but it's not much.
  - Retr0id 4mo ago
    If you have 256GB/s of memory bandwidth and 64GB of RAM, you can zero it all in 250ms.

liffik 4mo ago

Right

Retr0id 4mo ago

The code in the repo is trivial, that's not really what I was referring to. Getting DRAM cooled and swapped from one system to another is nontrivial, and I assumed most hardware/firmware zeroed memory on boot (to prevent being used to cold-boot-attack itself, without even needing a ln2-cooled board swap.) Those are the interesting aspects, not the code!

liffik 4mo ago
Ah, I see what you mean! You are totally right, the physical execution is the truly interesting part. To clarify, I actually didn't swap the RAM modules to another system. Moving cooled RAM is incredibly difficult and leads to rapid data decay. Instead, I left the frozen RAM exactly where it was on the original board. After the hard power-off, I just quickly swapped the system drive for my prepared drive and booted the same machine back up. Regarding memory zeroing on boot: that is a highly relevant point. Modern systems (especially with TCG MOR enabled) try to scrub memory during POST to prevent exactly this. However, two things help here: Fast Boot / Board Specifics: Many BIOSes, including the one on the industrial board I tested (DPX-W250), skip full memory checks and zeroing to speed up boot times. Hard Power-Off: By cutting power abruptly, the OS doesn't get a chance to set any "clean shutdown" flags. Upon reboot, the BIOS just did a quick POST and handed control to my 16-bit bootloader via CSM, leaving the frozen memory completely intact. P.S. I'm using AI to translate my messages because I don't speak English. Hope this explains the physics of the attack!
dlcarrier 4mo ago
Zeroing memory on boot is pretty slow. Modern CPUs support encrypting the RAM with a key generated at boot and lost when the processor powers off. This would give even better security under most circumstances, without the slow boot.
- alfiedotwtf 4mo ago
  Wow, that sounds quite slow? I wonder what speed boosts you could get if you disable this if this is not an attack vector you want to cover
  - dlcarrier 4mo ago
    It's done transparently in hardware, so it doesn't slow down the RAM.
    - Retr0id 4mo ago
      It usually has a latency cost, but it's not much.
- Retr0id 4mo ago
  If you have 256GB/s of memory bandwidth and 64GB of RAM, you can zero it all in 250ms.