theomarkettos

4 ms·

1. 1.▲
   by theomarkettos 8y ago

   We need to use an Intel Arria or Stratix FPGA due to the 'config bypass' feature we use to allow QEMU to implement its own PCIe config registers. Xilinx, Lattice and Cyclone FPGAs don't support this as far as I can tell.
2. 2.▲
   by theomarkettos 8y ago

   The vulnerability applies to all DMA-capable devices (ie Thunderbolt, PCIe, wifi and NVMe chips on mobiles, on-chip peripherals like mobile basebands). Thunderbolt 3 makes drive-by attacks easier, but in principle the attack could be carri
3. 3.▲
   by theomarkettos 8y ago

   There was actually an interesting talk on fuzzing drivers in the session before ours: https://www.ndss-symposium.org/ndss-paper/periscope-an-effec... We're working on porting to a cheaper FPGA-on-PCIe board, but i
4. 4.▲
   by theomarkettos 8y ago

   Author here. We don't break that prompt, however there are some problems. First is that Macs have no prompt at all, so you just need to use a device on the whitelist and you're approved. Second, the prompt says 'you attache
5. 5.▲
   by theomarkettos 8y ago

   Post author here. That was what I was thinking of - simply overdriving the lines to drag them high or low in opposition to the 'official' driver. That's pretty much all you can do with 6 pins. I was trying not to overcompli