Secret AMD Debugger

[digibucc]

http://www.woodmann.com/collaborati...secret_debug_capabilities_of_AMD_processors_!

'Super-secret' debugger discovered in AMD CPUs
Password-protected feature goes beyond x86

By Dan Goodin in San Francisco
Posted in PCs & Chips, 15th November 2010 19:10 GMT

A hardware hacker has discovered a secret debugging feature hidden in all AMD chips made in the past decade.

The password-protected debugger came as a shock to reverse-engineers who have hungered for an on-chip mechanism for performing conditional and direct-hardware breakpoint operations. Although AMD has built the firmware-controlled feature into all chips since the Athlon XP, the company kept it a closely guarded secret that was only disclosed late last week by a hacker who goes by the name Czernobyl.

“AMD processors (Athlon XP and better) have included firmware-based debugging features that expand greatly over standard, architecturally defined capabilities of x86,” the hacker wrote. “For some reason, though, AMD has been tightly secretive about these features; hint of their existence was gained by glancing at CBID's page.”

To put a chip into developer mode, a user must first enter what amounts to a password — 9C5A203A — into the CPU's EDI register. Czernobyl was able to deduce the secret setting by brute forcing the key.

Presumably, the debugger is an internal AMD utility used during development and then turned off before shipping. Its discovery by world + dog means that everyday users may have powerful new tools to hack, debug, and reverse-engineer their hardware. Now that its existence and the instructions for turning it on are known, the real discoveries about exactly what can be done with it are sure to commence. ®

did search, didn't see it, sry if i'm blind
also, this should probably be in AMD/ATi huh? my bad.

 

[KainXS]

so what does this mean wiz

 

[W1zzard]

won't have much use for the general public. most of the people who call themselves tech journalists have no clue what all the funky words in the original article mean so they come up with explanations that make sense to them

basically it enables some additional debugging capabilities that allow better control on when a debug event occurs. this might be of use for operating system kernel developers, probably not even for them as there are no software tools that support these features. normal application developers rely on the debugging facilities of their development software that offers all such features at a non-hardware level "emulated" by the debugger but in a nice colorful clicky click representation

there is no security implication. access to MSRs is only available from kernel mode. if your virus is in kernel mode it can already do everything it wants, no need for those additional debug capabilities

 

[wahdangun]

wtf, is this some kind performance enhancing ???

 

[W1zzard]

wtf, is this some kind performance enhancing ???

no it will not performance enhance anything. it lets you set a breakpoint with complex conditions that causes the equivalent of a bluescreen when the condition it met and/or the breakpoint address is reached

 

[digibucc]

thanks for the link change, that site is MUCH better had never seen it before ...

 

[Mussels]

what are these breakpoint operations all about?

 

[PVTCaboose1337]

Here is the super sweet code list to decode what you see.

http://cbid.softnology.biz/html/undocmsrs.html

 

[Steevo]

what are these breakpoint operations all about?

Lets say you want a exact picture of what is happening step by step during a programs run time. You set a breakpoint (system state stop) to occur at the time you want in the execution by setting perimeters that you define for the stop.


Comparing it to a event, it would be like saying stop a engine with the exact flame front in a cylinder as it is occurring. Basically think of freezing time.


So we could say executable Adobe32.exe is having performance problems when multitasking with XXX program. You could run them and get exact dumps of state as they occur through each step, analyze the data and implement fixes, or just tell adobe they suck.

 

[robn]

Yeah a breakpoint is a pre-set pause point in a code sequence in a program being debugged.

A program is going wrong somewhere and needs to be fixed. So the programmer wants to know what everything (data, threads, files open, etc.) looks like when their code reaches a certain instruction that they think might be in the problem area. A breakpoint tags that instruction, and the system pauses execution when it reaches the tag, to allow the developer to do whatever inspection they want. The program can be continued or aborted from that point as the dev sees fit.

In the case of this news, these AMD chips provide extra triggering options for the break to occur.