Hacker News

TBH with the DDD debugger you had a graph with the C structures right away.

x86 Software Reverse‐Engineering, Cracking, and Counter‐Measures By Stephanie Domas and Christopher Domas

https://onlinelibrary.wiley.com/doi/book/10.1002/97813942771...

Then publishing it in this incomplete state is just pointless fearmongering and will just make others fill in this information within the next couple of days. And the good guys likely won't be the first ones to do that.

But it supercharges what can be done once you get root, no?

Yeah, just started looking at this with my team (we run a cloud with VM instance offering on AMD so this very much caught our eye)

So far seems this is about right:

1. You need platform register access, so seems can't KVM-escape with just this

2. Big question is what about breaking Confidential SEV-SNP guests from the host?

When Chris Domas left Battelle for Intel years back, shortly after hardware-fuzzing a bank of thin-clients to discover undocumented x86 instructions, I was convinced Intel was basically keeping him on the payroll to shut him up.

Which arguably is a good thing. As a owner of the system I really should have complete control over it. But currently there is software I have no control over running at even higher privilege levels.

The only modern silicon that gives me full control over what code is running is some (or most?) microcontrollers.

And this isn't just a question of FOSS principle. Especially SMM is problematic by unpredictably taking CPU cycles away from your workload. This can mess up hard realtime workloads, such as found in CNC controllers. If you are running something like LinuxCNC this something you need to measure to figure out if a given computer is suitable for that job.

I'm not the person you are replying to, but the readme is very clearly written by an AI, and it sounds nothing like his older work. Sometimes it's just super clear to people something is written with AI without you getting some sort of singular "gotcha" word or indicator. It's just writing patterns that would be hard to clearly establish rules for here in an HN comment, but it's incredibly obvious when you learn to spot it.

> Please be more specific.

The em dashes are the most obvious stereotypical tell, but that doesn't really matter that much (I actually like them and occasionally used them pre-AI). It's hard to put a finger on, but the most annoying LLMism to me is the overdramatic, staccato, almost "epic" way they talk. It feels like a 2009 lens flare effect over everything, it sounds like a stereotypical hacker in a CSI show.

> the last generation whose datasheets document the DRAM controller's translation registers — and show that they can't be locked

> When your code dereferences *p, it appears to access the DRAM at p. It does not — p is a virtual address

> Physical addresses are really more of a suggestion.

> That's the exploit. All of it.

The worst part is that this stuff is genuinely cool and deserves to be dramatic. And I like stereotypical, campy hacker speak! But LLMs are, IDK... bad at it? Or maybe it just becomes a bore to read the same. Exact. Dramatic. Voice. From literally everyone. After you've heard it enough times.

None of this is against Mr. Domas. He seems like a cool person, with a cool voice, and I want to read his voice, not Claude's.

> What if you're wrong?

I definitely could be! Apologies if I am. But with all the em dashes and such, and having read his previous work, I felt confident enough to mention it. And as the sibling comment says, it really is something you just learn to spot over time.

"What if you're wrong?"

I'd just like to address this real quick because some people seem to think this is just a "hunch" that has some probability of being false; there is absolutely nothing more certain on planet Earth than the LLM involvement in this writing. It is difficult to come up with things that are certain enough to compare this to to convey the lack of doubt that exists.

I am not going to make fun of you for not being able to tell, although I do find it surprising that people seem to struggle in both directions with telling AI and human writing apart (are our brains really that different?) - I just want it to be clear that some of us can pick up Claudisms within just a couple of sentences with no effort. A Claude-generated sentence, in isolation, may not ring any alarm bells. A few of them in a row, however, that's a load-bearing smoking gun right there.

We can certainly argue to what extent undisclosed LLM involvement is an issue or not, though frankly I don't like reading LLM writeups so I would greatly prefer if people would stop using LLMs for public facing documents. But, it is at least worth making this much clear: we can tell.

[dead]

Late edit: It also makes it harder to exploit rowhammer etc., if the precise swizzling method is unknown.

Likewise -- also had zero issues going over this with Sol. Seemed to give solid advice for how to test it -- use an expendable bare-metal AMD family 16h test system w/ usual standard checks that apply.

> Run `platform_check` first and do not use `SKITTER_FORCE=1` casually. Start with the read-only `dram_state` and `dram_carveouts`, then `dram_dump --dry-run`. Avoid `dram_poke` until maps have been freshly collected and calibrated. Do not bypass fingerprint checks, calibration, fencing, or verification.

Claude's (apparently externally-mandated?) lobotomization continues to be concerning. :-/

Nah, it's not just that, literally all the stuff they've posted this year is obvious LLM writing, none of the stuff from previous years is. To get this close to LLM writing style without actually using an LLM, you would pretty much have to be purposefully trying.

But I have a new favorite way of demonstrating this:

https://github.com/search?q=owner%3Axoreaxeaxeax+load-bearin...

Guess how many of these are from before 2025.

> Hawking was English.

Odd, he had an American accent.