Breaking the x86 Instruction Set on HackerTube: recommended by 9 Hacker News commenters across 8 separate months, 2017–2022.
talk · advanced · evergreen
Christopher Domas presents at Black Hat 2017 how page fault analysis and processor fuzzing can exhaustively search the x86 instruction set. The talk uncovers undocumented instructions and hardware bugs and shows limits of disassemblers.
HN recommends it as a clever, entertaining and easy-to-follow talk on finding hidden x86 instructions with the Sandsifter tool.
“I found it easy to follow and pretty entertaining.”
17 Hacker News comments link this video. Each one links back to its thread.
I watched a super interesting Black Hat video on youtube that talked about discovering secret instructions on CPUs by iterating over each bit of opcodes until you get an illegal instruction, and thereby discovering if an opcode is valid or not. He set up a room full of PCs running his code and had hardware to auto-reset them when they crashed. ▶ this video
in “Undocumented x86 instructions to control the CPU at the microarchitecture level [pdf]” · View on HN
How about undocumented instructions? Sandsifter[1] is an interesting project and the video from BlackHat[2] is a good watch. There's also a previous discussion of it on HN[3]. [1] [link] [2] ▶ this video [3] [link]
in “How many x86 instructions are there? (2016)” · View on HN
There was an interesting black hat talk about automatically finding undocumented instructions. [0] Interesting comment on twitter to the instruction of the original post[1] [0] ▶ this video [1] [link]
in “Undocumented x86 instructions in Intel CPUs that can modify microcode” · View on HN
"I thought you were saying that the use of microcode would complicate verification of the hardware." I do think that microcode opens up the possibility of subtle injections to follow code/hardware paths you might not easily predict. A really good talk on reverse engineering an ISA implementation: ▶ this video
in “XuanTie C906 based Allwinner RISC-V processor to power $12 Linux SBC's” · View on HN
There was a really good Blackhat talk a year or two ago in a sort of similar vein: they developed an approach to iterate and find undocumented opcodes. ▶ this video The software they developed is called Sandsifter.
in “A Complete Formal Semantics of x86-64 User-Level Instruction Set Architecture” · View on HN
Breaking the x86 Instruction Set by Christopher Domas. ▶ this video I found it easy to follow and pretty entertaining.
in “Ask HN: What are some of the best technical talks you've heard?” · View on HN
One of my favourite talks I watched was "Low Cost Non-Invasive Biomedical Imaging - An Open Electrical Impedance Tomography Project" [link] As it presented an interesting technique I'd never heard of before, along with an implementation. Also I thought the 'Breaking the x86 Instruction Set' talk was extremely clever - ▶ this video
in “Ask HN: What’s your favorite talk from 2017?” · View on HN
my favorite were: - How the reputation economy is creating data-driven conformity [link] - DEF CON 25 (2017) - Weaponizing Machine Learning [link] - BlackHat 2017: Breaking the x86 Instruction Set ▶ this video
in “Ask HN: What’s your favorite talk from 2017?” · View on HN
> I trust its disassembler (especially for mainstream languages) more than almost any other disassembler Might I suggest Christopher Domas' Black Hat talk "Breaking the x86 ISA", along the way of which he demonstrates the limitations of all disassemblers out there, including IDA's :) Talk: ▶ this video Slides: [link] Paper: [link]
in “IDA: What's new in 7.00” · View on HN
What are the implications of such hardware on user security? Threat persistence, i.e. persistent rootkits, persistent remote monitoring if one has privs to tickle the CPU instructions that give access. It is just a matter of time before there are public tools for script kiddies to manage the OS within the CPU. Here [1] is an example of someone slowly making progress decoding all the undocumented instructions and here is a talk with a brief overview of the tools. [2] This is not specific to Intel's ME but it is the way people will eventually tame/exploit that beast in my opinion. There are more recent talks that get deeper into security rings in the CPU. This video [3] more related to your question but not specific to ME however can be used to access ME and much more. If this appears to difficult and time consuming just know that some folks out there have the documentation for the undocumented instructions. You may find some tools on github and other public repos for disabling ME. Use with care. Test on an identical model of system that is at the same firmware/BIOS and same model of CPU as those tools can brick your CPU. As @rocket_surgeron stated, one can buy CPU's with ME disabled but that will not disable the "God Mode" referenced in [3]. [1] - [link] [2] - ▶ this video [3] - [link]
in “Ask HN: Do you worry about CPU backdoors like IME?” · View on HN
I would be really interested to see how often malicious software utilized undocumented opcodes that disassemblers incorrectly interpret and thus lead a security researcher down a rabbit hole while the actual opcode does something different. Like the 66e9xxxxxxxx and 66e8xxxxxxxx opcodes in x86_64 [1] If my understanding is correct, Stuxnet incorporated bytecode for the PLCs in S7comm, a protocol that was not open at the time. Though this is different then including undocumented opcodes for the system being targeted directly. [1] ▶ this video
in “A Silly Anti-Disassembly Trick” · View on HN
xoreaxeaxeax's videos about how to systematically parse the asm space of x86 really hit home to me how bad the encoding is. ▶ this video
in “Cosmopolitan Libc: build-once run-anywhere C library” · View on HN
This was also linked elsewhere but a security researcher was able to identify a significant number of undocumented instructions: ▶ this video
in “Undocumented CPU behavior: analyzing undocumented opcodes on Intel x86-64 (2018) [pdf]” · View on HN
Great project and write-up. I'm reminded of a couple other projects. MC Hammer project for LLVM tests round-trip properties of the ARM assembler. [link] Sandsifter x86 fuzzer. [link] ▶ this video
in “Destroying x86_64 instruction decoders with differential fuzzing” · View on HN
I do also wonder if some speculative prediction / branching stuff can be controlled through undocumented CPU instructions: ▶ this video
in “Reading privileged memory with a side-channel” · View on HN
Related talk (relevant part starts at 38:43) ▶ this video Quote from the talk: I don't want to make it sound like the sky is falling. This was found on one very esoteric processor that is not used in widespread production. I think it's mostly interesting from an academic perspective that we have a tool that is able to find these kinds of things now.
in “A CPU bug with undocumented opcodes, possibly Intel (scroll to p. 155)” · View on HN
Data Breach Transparency - At a minimum, their should be a penalty that grows from the time the breach was learned to when they disclose it publicly. - There should also be penalities for not being transparent about what exact data was leaked for what users. Social Security Number - SSN is similar to a password- you want to keep it hidden, and if it leaked, you should change it. However, we can't change it. Perhaps it should be considered more as a password? User Data Rights - People should know what personal data companies have on them. A good example of this is Equifax storing peoples home addresses- this could be disclosed. On the other hand, a it is probably fine to exclude other types of data, such as an advertiser storing your zip code- people probably don't care as much. - Should people have a right to have certain kinds of data (e.g. SSN) removed from websites? Adoption from USA Nutrition Label - Is it a good idea to mandate companies disclose the security they use? For example, at one time reddit had their passwords stored as plaintext and they got hacked. Disclosing basic security hygiene (e.g. password storage) somewhere standardized in the website would make it much less outrageous. Technology Improvement - Certain technologies enable hackers more than others. SQL seems to enable a lot of hacking. Should we discourage it? - Get rid of Intel ME technologies - [link] - Get rid of Intel hidden instructions - ▶ this video - Get rid of Simon and Speck - [link] - What is "be
in “I'm Testifying to Congress about Data Breaches – What Should I Say?” · View on HN