USENIX Security '17 - Reverse Engineering x86 Processor Microcode

Philipp Koppe, Benjamin Kollenda, Marc Fyrbiak, Christian Kison, Robert Gawlik, Christof Paar, and Thorsten Holz, Ruhr-University Bochum
Microcode is an abstraction layer on top of the physical components of a CPU and present in most general-purpose CPUs today. In addition to facilitate complex and vast instruction sets, it also provides an update mechanism that allows CPUs to be patched in-place without requiring any special hardware. While it is well-known that CPUs are regularly updated with this mechanism, very little is known about its inner workings given that microcode and the update mechanism are proprietary and have not been throughly analyzed yet.
In this paper, we reverse engineer the microcode semantics and inner workings of its update mechanism of conventional COTS CPUs on the example of AMD’s K8 and K10 microarchitectures. Furthermore, we demonstrate how to develop custom microcode updates. We describe the microcode semantics and additionally present a set of microprograms that demonstrate the possibilities offered by this technology. To this end, our microprograms range from CPU-assisted instrumentation to microcoded Trojans that can even be reached from within a web browser and enable remote code execution and cryptographic implementation attacks.
View the full program: www.usenix.org...

[@eclipsegst9419]

Some day soon, we will be able to easily hack the microcode of all the locked intel processors and be able to overclock all of them :) That will be an amazing day. 20 core Xeons that cost 100 bucks @ 5Ghz? yes please!

[@genkidama7385]

one dislike from intel. hhhhhhhhh

[@jeffreycliff922]

Please consider putting the code for this online somewhere other than NSA/Microsoft Github! Or, alternatively, giving permission via some kind of free software license for the world to use the version you had in 2018 back before NSA/Microsoft bought Github!

[@neilbradley]

"x86 CPUs are prone to errors". All CPUs are prone to errors.

[@Sparkette]

So is KZbin apparently-the auto-generated captions are in German even though he's speaking English.

[@st1cky953]

Is it possible to remove Melt/Spec Patch from the Microcode that 9700k (906ED) uses? I heard it is Hardware Patched what is it mean? Is there anyway to bypass it or deactivate it anyway?