Holy crap. This is like a software-reachable version of the dynamic memory aliasing hardware attack demonstrated by https://batteringram.eu/

The researcher behind this is obviously highly knowledgeable in reverse engineering CPUs to the tune it reminds me of the dwarves digging in Moria...

But why on earth do they have to use AI to write their writeups?!

I cannot wait for the accompanying Black Hat talk. Christopher Domas is one of my absolute favorite all-time hackers. He does such a fantastic job of explaining his work. Some of my favorite talks of his:

- Psychological Warfare in Reverse Engineering https://www.youtube.com/watch?v=HlUe0TUHOIc

- The MoVfuscator https://www.youtube.com/watch?v=R7EEoWg6Ekk

- Hardware Backdoors in redacted x86 https://www.youtube.com/watch?v=jmTwlEh8L7g

Holy shit, Christopher Domas is back. I remember watching his Defcon talks on x86 shenanigans[^1][^2] and being amazed at what he's been able to discover. Then he got whisked away by Intel and now drops this. I'm excited.

[^1]: https://www.youtube.com/watch?v=XH0F9r0siTI

[^2]: https://www.youtube.com/watch?v=jmTwlEh8L7g

So on an affected system, ring 0 root has access to pretty much everything that was hidden in negative ring territory. The page is pretty quiet about what other processor families might be similar beyond this specific AMD16h (an older AMD low-power family)?

Fascinating. So what is the DCT swizzling functionality designed for in the hardware originally?