Breaking the x86 Instruction Set
Exhaustively searching the x86 instruction set to uncover secret instructions, hardware glitches, and hypervisor flaws.
Summary
Hardware Reverse Engineering
Modern x86 processors contain secret instructions and hardware bugs beyond documented specifications. The presentation demonstrates how page fault analysis and creative processor fuzzing exhaustively search the x86 instruction set to discover undocumented functionality.
Research Methodology
Using fuzzing techniques against the processor itself, researchers identify execution patterns that reveal hidden instructions and hardware behaviors. This approach uncovers secrets buried in chipsets and processor implementations.
Findings and Impact
The research discloses new x86 hardware glitches, previously unknown machine instructions, and ubiquitous software bugs. Additionally, the work reveals flaws in enterprise hypervisors that make use of x86 features.
Tooling Release
The Sandsifter toolset is released to allow security researchers to audit and break their own processors, democratizing the ability to discover processor vulnerabilities and undocumented behaviors.
Related talks
Main Stage·37 min
Mathias Krog · Christian Skovsende
Reverse engineers Intel CPU microcode on Goldmont cores, achieving persistent userspace microcode patching on Linux to create hardware backdoors in x86 execution.
Main Stage·46 min
Christopher Domas
Christopher Domas presents god mode unlocked hardware backdoors in redacted x86: Complexity is increasing.
Main Stage·42 min
Josep Pi Rodriguez
Josep Pi Rodriguez presents wingos: how to own millions of devices .: Extreme network's embedded WingOS (Originally created by Motorola) is an operating system used in several wireless devices such as access points...