Intel Microcode Decrpyor

• MicrocodeDecryptor

  15 1,478 0.0 Python

• crbus_scripts

  2 117 0.0 Python

  IPC scripts for access to Intel CRBUS

These researched managed to do this! (PoC). Modifying microcode is possible thanks to their previous work. By exploiting bugs in the BUP module (responsible for hardware bring-up/initialization) in the TXE firmware (Trusted Execution Engine, the Atom analogue of the Management Engine on Core/Xeon), they were able to eventually enable Intel's internal JTAG interface, also known as red unlock. This is normally disabled on production systems and requires keys from Intel to unlock it. However, a design flaw in BUP combined with code execution allowed red unlock to be enabled without Intel's keys. Red unlock is extremely powerful - not only does it let you debug the CPU core, it also lets you debug other devices and IP blocks (including TXE/ME). You can even use it to access internal microarchitectural state, including the microcode sequencer ROM. This allowed them to dump the (decrypted) microcode from a Goldmont CPU. They eventually managed to reverse engineer the micro-op format and released a microcode disassembler.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• IntelTXE-PoC

  2 136 10.0 Python

  Intel Management Engine JTAG Proof of Concept (by chip-red-pill)

These researched managed to do this! (PoC). Modifying microcode is possible thanks to their previous work. By exploiting bugs in the BUP module (responsible for hardware bring-up/initialization) in the TXE firmware (Trusted Execution Engine, the Atom analogue of the Management Engine on Core/Xeon), they were able to eventually enable Intel's internal JTAG interface, also known as red unlock. This is normally disabled on production systems and requires keys from Intel to unlock it. However, a design flaw in BUP combined with code execution allowed red unlock to be enabled without Intel's keys. Red unlock is extremely powerful - not only does it let you debug the CPU core, it also lets you debug other devices and IP blocks (including TXE/ME). You can even use it to access internal microarchitectural state, including the microcode sequencer ROM. This allowed them to dump the (decrypted) microcode from a Goldmont CPU. They eventually managed to reverse engineer the micro-op format and released a microcode disassembler.

• uCodeDisasm

  7 339 3.4 Python

These researched managed to do this! (PoC). Modifying microcode is possible thanks to their previous work. By exploiting bugs in the BUP module (responsible for hardware bring-up/initialization) in the TXE firmware (Trusted Execution Engine, the Atom analogue of the Management Engine on Core/Xeon), they were able to eventually enable Intel's internal JTAG interface, also known as red unlock. This is normally disabled on production systems and requires keys from Intel to unlock it. However, a design flaw in BUP combined with code execution allowed red unlock to be enabled without Intel's keys. Red unlock is extremely powerful - not only does it let you debug the CPU core, it also lets you debug other devices and IP blocks (including TXE/ME). You can even use it to access internal microarchitectural state, including the microcode sequencer ROM. This allowed them to dump the (decrypted) microcode from a Goldmont CPU. They eventually managed to reverse engineer the micro-op format and released a microcode disassembler.

Suggest a related project