- 10 Αύγ 2015, 11:43
#146891
η ιστορια εχει πολυ πλακα ομως
“The P6 family processors permit the starting address of the APIC registers to be relocated from FEE00000H to another physical address. This extension of the APIC architecture is provided to help resolve conflicts with memory maps of existing systems.”
– Intel SDM, c. 1997
A forgotten patch …
… to fix a forgotten problem …
… on a tiny number of legacy systems …
… 20 years ago.
4 bits …
to take control of the most
privileged mode of execution
on the processor
...
0f 09 c7 05 14 00 01 00 ff 9a cf ff c7 05 10 00 01 00 ff ff a2 9f b8 00 f9 5f 1f ba 00 00 00 00 b9 1b 00 00 00 0f 30 eb fe
The Memory Sinkhole
8 lines, to exploit
Hardware remapping
Descriptor cache configurations
Instruction and data cache properties
Four execution modes
Four memory models
… and infiltrate the most privileged mode of execution on the processor
What do we do with this?
Unlock hardware
Disable cryptographic checks
Brick the system
HCF
Open the lock box
Or just install a really nasty rootkit
SMM Rootkit
With SMM execution, can install to SMRAM
Preempt the hypervisor
Periodic interception
I/O filtering
Modify any memory
Invisible to OS
Invisible to AV
Invisible to Hypervisor