Lee

14 posts

Lee

Lee

@endbr64

...

Washington, DC شامل ہوئے Eylül 2009
186 فالونگ127 فالوورز
Lee ری ٹویٹ کیا
Mark Ermolov
Mark Ermolov@_markel___·
Hardware glitching masters have taken on Intel's microarchitecture - very, very cool! I'm so glad our work is contributing to research that was previously unimaginable. Research into hardware attacks on Intel processors has enormous potential... download.vusec.net/papers/microsp…
English
1
36
170
25.2K
Lee
Lee@endbr64·
@IntelSecurity Your email, project.circuit.breaker@intel.com, is not working. Getting error replies. I was told by the nice lady at the booth to email yall when I finished all 6 challenges since no one at the conference got them all.
English
0
0
6
38
Intel Security
Intel Security@IntelSecurity·
Calling all #hackers and hobbyists, #ProjectCircuitBreaker will be at #ShmooCon starting this Friday. Our team has something special planned just for you, and we heard there are goodies for anyone who solves some #hacking challenges. Comment below if you are joining us.
Intel Security tweet media
English
2
2
6
695
Lee
Lee@endbr64·
@pcb_shmoocon24 , your email isn't working. I have the Color Challenge answer. Could you verify it please?
Lee tweet media
English
0
0
0
31
Lee
Lee@endbr64·
@gerhart_x @standa_t Can you write a blog on how exactly to set this up? I've only gotten it to work for QEMU and 32bit VMware. The support for 64bit Vmware guest was only committed last week, so I guess you made your own modifications to it?
English
2
0
1
96
Lee
Lee@endbr64·
@standa_t I've tried, but it doesn't seem to be working 🫤. I added "VMWare" to the ValidateSet for $ExdiTarget (not sure how the dev didn't put that in there..), In the .ps1. I get "Target initialization succeeded" and initial break-in, but lots of registers are 0 and can't step.
English
2
0
0
171
Lee
Lee@endbr64·
If you have a newer UP2 board (March 2020+), and you cannot boot the opensource firmware, I have a fix for you! github.com/henshaw777/UP2…
English
0
0
5
2.1K
Lee
Lee@endbr64·
@ivanrouzanov Nevermind. Idk why my early experiments showed this. For some reason my new test loop shows that glm_cN maps to thread[N]. Thanks for the idea! I was definitely using glm_module0 beforehand though and that was previously mapping to thread[1]. There somehow was some swapping...
English
0
0
0
0
Lee
Lee@endbr64·
@ivanrouzanov Experimenting further. "glm_c0" will affect thread[2]. c1 and c2 also affect thread[2]. glm_c3 will affect thread[3]. Seems unintuitive to me. Any good resources on learning this stuff formally?
English
1
0
0
0
Lee
Lee@endbr64·
Finally figured out why my microcode patch didn't seem to be working at all. On a whim I decided to check the other cores. Turns out it worked, just only on one core? Why?
Lee tweet media
English
1
0
0
0
Lee
Lee@endbr64·
@ivanrouzanov Oh true! If I switch glm_module0 for the glm_module1 device, it works on thread 3. I don't know how to get it working on thread 0 or 2 though. Unfortunately, I don't see any explanation about how these scripts work or what some of the hardcoded values mean.
English
1
0
0
0
Lee
Lee@endbr64·
@ivanrouzanov I should've added more context. I am manually patching custom uCode based on the research and scripts from github.com/chip-red-pill/…. I'm guessing you think I meant a legit uCode update via the normal MSR procedures. I'm not sure how to specify the core # in those scripts.
English
1
0
0
0
Lee
Lee@endbr64·
Want to unlock undocumented Intel instructions and execute custom microcode? I am starting a tutorial series to delve into some of the work from the uCode Research Team! Unlock your CPU and Execute Arbitrary Microcode! Tutorial Introduction youtu.be/jxU6uwGsO48
YouTube video
YouTube
English
4
85
209
0
Lee
Lee@endbr64·
@standa_t Are you able to break on VMEntry/Exit? You mentioned in class that wasn't working (on UP2) and I noticed the same behavior.
English
1
0
0
0
Satoshi Tanda
Satoshi Tanda@standa_t·
Can confirm this works as advertised. Do not even need to flash BIOS to make DCI DbC3 work. Anyone who wants to debug and reverse engineer firmware from the reset vector, SMM, hypervisor, or any pieces of software that do not work with kernel debuggers, I recommend this
Satoshi Tanda tweet mediaSatoshi Tanda tweet media
Alan Sguigna@AlanSguigna

Taking a cue from @ilfak, we're offering our JTAG debugger SourcePoint at a new low price of $365 for hobbyists and researchers, to work with the AAEON UP Xtreme i11 Tiger Lake board over DCI: asset-intertech.com/resources/blog…

English
3
14
51
0
Lee
Lee@endbr64·
@HackingThings Does it work right out of the box? Or do you need additional documentation/files that you would otherwise need to get with an NDA?
English
1
0
1
0
Mickey
Mickey@HackingThings·
✅ Received ✅ Tested ✅ Appropriately labeled
Mickey tweet media
English
2
0
8
0