MicrocodeDecryptor VS IntelTXE-PoC

Microcode decryptor A team of researchers has released a tool to decrypt and unpack the microcode for some low-power Intel CPUs. This makes possible to understand how Intel has implemented various security fixes and features. Among the security fixes you can find the one about the famous Spectre vulnerability. Among the features you can dig into the implementation of Intel TXT, SGX or VT-x.

Intel Microcode Decryptor\ (253 comments)

These researched managed to do this! (PoC). Modifying microcode is possible thanks to their previous work. By exploiting bugs in the BUP module (responsible for hardware bring-up/initialization) in the TXE firmware (Trusted Execution Engine, the Atom analogue of the Management Engine on Core/Xeon), they were able to eventually enable Intel's internal JTAG interface, also known as red unlock. This is normally disabled on production systems and requires keys from Intel to unlock it. However, a design flaw in BUP combined with code execution allowed red unlock to be enabled without Intel's keys. Red unlock is extremely powerful - not only does it let you debug the CPU core, it also lets you debug other devices and IP blocks (including TXE/ME). You can even use it to access internal microarchitectural state, including the microcode sequencer ROM. This allowed them to dump the (decrypted) microcode from a Goldmont CPU. They eventually managed to reverse engineer the micro-op format and released a microcode disassembler.