hilmipilmi

I used it to look into Gigabytes response to Intel SA 00075 described in https://embedi.com/files/presentations/BH-Las-Vegas-2017-Int....

before: http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5ha(a...

after: http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5ha(a...

You can see that there is an extra function call added that tests for response.length.

Given the easy availability of the assembler dump you can expect progress towards demystifying IME. I'm not a professional in the security field, but I sense that there is lots of possibilities by just doing a "strings image/00275000.NFTP/amt.mod". Gigabyte might be special, but they have left their assert prints in the code and you can get a sense what the thing is doing...

If there is a IME firmware update popping up before this talk, dont apply it if you want to be able to run unsigned code yourself.

It feels reassuring that you can actually get access and read the assembly of the IME now, thanks to https://github.com/ptresearch/unME11. For instance using the the Gigabrix-BSi5ha-6200 IME Firmware update archive:

1. Download and unzip the Gigabrix-BSi5ha-6200 IME update archive (http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5-h-a...). Use F5_BIOS/image.bin from that archive.

2. Start "python unME11.py image.bin"

3. The uncompressed modules are located in image/00004000.FTPR/* after that

4. You can i.e. load image/00004000.FTPR/kernel.mod in IDA using 80486 in 32bit real-mode or use "objdump -m i386 -b binary -D kernel.mod --adjust-vma=0x80000" with entry point being 0x80000 or "objdump -m i386 -b binary -D bup.mod --adjust-vma=0x2d000" with entry point being 0x2D04C

TLBs index a tag with the higher bits and compare one retrieved value for equality only. A PLB with arbitrary resolution would need to do 2 subtractions for the 2 compares and do that for all active entries in parallel. That is, for every simple load/store in a 16 entry PLB you'd need to do 32 subtractions! Unless you come up with a novel scheme to handle this your chip will get hot. Maybe you can reconstruct the indexing TLB scheme on the fly in hardware or something like that, or have an special purpose embedded Cortex-M3 that recreates an efficient lookup structure for the MILL :-). And no, a 64 bit subtraction is not one clock cycle when you run at 1ghz.

One that seems reasonably simple is: https://lwn.net/Articles/578295/