TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Exploiting DRAM bitflips to get a root shell

104 点作者 goranmoomin8 个月前

8 条评论

mikewarot8 个月前
&lt;rant value=&quot;verbose&quot;&gt;<p>It&#x27;s circuit bending, or Fritzing, not finding a clever exploit in DRAM. Even an ECC module isn&#x27;t going to help you if it&#x27;s on the CPU data bus.<p>I just hope we don&#x27;t all end up suffering through yet another 50% slowdown in patches to the Kernel to avoid this nonsense because someone buys the BS and now it has to be &quot;fixed&quot;, like the row hammer software fixes, instead of just fixing the dam DRAM modules, and better hardware.<p>&lt;&#x2F;rant&gt;<p>Another analogy:<p>It&#x27;s like when a brain surgeon probes your cerebellum and suddenly you smell strawberry or hear Brahms. The surgeon certainly doesn&#x27;t know what reaction you have unless you tell them.<p>You wouldn&#x27;t go around later saying &quot;Dr Jones made me smell strawberries, on a whim, certainly he&#x27;s a G*d&quot;
评论 #41752219 未加载
评论 #41761639 未加载
captn3m08 个月前
Some context from the author’s fedi account:<p>&gt; I&#x27;m exploring this because I think it might be useful for console hacking - where you have physical access, and the ability to execute sandboxed code (say, inside a web browser)<p>ID: @retr0id@retr0.id (they ask not to link to their fedi instance).
sans_souse8 个月前
This is some low level hacking right here
backspace_8 个月前
Do I need a lighter or the matrix soundtrack to accomplish this hack.
评论 #41750345 未加载
dan_linder8 个月前
So if we don&#x27;t have the addition of the antenna wire, is the usual case shielding sufficient or do we just need larger&#x2F;intense pulses, more of them, or somewhere in between? is like to try this at home, but not if I have to solder a wire on the already small RAM traces.
评论 #41749949 未加载
评论 #41752193 未加载
azalemeth8 个月前
Yet again, I wish we all had ECC ram!<p>Here&#x27;s the code: <a href="https:&#x2F;&#x2F;github.com&#x2F;DavidBuchanan314&#x2F;dram_emfi&#x2F;blob&#x2F;main&#x2F;linux_x86_64_lpe.c">https:&#x2F;&#x2F;github.com&#x2F;DavidBuchanan314&#x2F;dram_emfi&#x2F;blob&#x2F;main&#x2F;linu...</a> -- the basic idea is<p>&gt; Hardware setup: This time I put the &quot;antenna&quot; wire on DQ25, which will fault 64-bit values to +&#x2F;-32MiB<p>&gt; Exploit strat: We fill up as much of physical memory as possible with page tables.<p>&gt; When we fault a PTE read, we have a good chance of landing on a page table, giving us R&#x2F;W access to a page table from userspace.
CTDOCodebases8 个月前
I remember kids using these things into Street Fighter II machines to get free credits.
ano-ther8 个月前
Impressive! And a music track like that should be standard for all progress bars.