Conversation

Jevin Sweval
@jevinskie
Want to own the SMU coprocessor in your AMD CPU/APU/possibly GPU? Extract the firmware signing HMAC key from the bootrom? Pre-Zen only, since its based on LM32 architecture features while Zen and later switched to Xtensa cores for their SMUs.
github.com
GitHub - jevinskie/amd-lm32-smu-exploit: Generic exploit for all version 7 (maybe others) LM32-ba...
Generic exploit for all version 7 (maybe others) LM32-based AMD SMU's used in APUs (and probably works on GPUs too) - GitHub - jevinskie/amd-lm32-smu-exploit: Generic exploit for all versio...
2
148
Jevin Sweval
@jevinskie
I don’t own an Xbox One and haven’t tested there. PS4’s APU/SMU has some oddities that prevents this attack In its current form (or I’m just making a stupid mistake somewhere).
3
16
SKHILLLZZzz
@skhilllz
Oh you found a common design flaw have you figured out all niches concerning the exploit? Or there's still a bit to explore?
1
Jevin Sweval
@jevinskie
Exploit lets you read/write to x86 DRAM physical and use the serial port. That would allow a 4 wire “modchip” (some uC with VCC, GND, RX, TX) to talk over UART to stubs injected in a patched SMU FW that perform patches usually done from a userland/WebKit kexploit.
1
2
Jevin Sweval
@jevinskie
There’s not enough SRAM to hold all the patches needed, thus the requirement of a uC talking to SMU proxy stubs. Through limited testing (it’s a PITA compared to just using Linux on a PC) on the PS4, the writes to some of the SMU BP regs are ignored/blocked. Maybe AMD got wise?
1
2
Jevin Sweval
@jevinskie
But we have the PS4 SMU bootrom and FW dumped via other means and can analyze it for other vulns that might allow code execution. I’m also working on a PCIe MITM like marcan did to better understand the boot process of PS4 over PCIe instead of the normal read from SPI flash.
202
Views
3
Likes