Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How was the rosenbridge coprocessor, and its instruction set, discovered? #6

Open
i336 opened this issue Aug 10, 2018 · 2 comments
Open

Comments

@i336
Copy link

i336 commented Aug 10, 2018

I think this is the penultimate question on everyone's minds right now.

Okay, so sandsifter did the heavy lifting; but that just firehoses random instructions at the CPU and looks for interesting results. That sounds like it would generate a nontrivial amount of noise - not so much so as to make the whole process overly tedious or simply unviable, but enough that skill and experience would be paramount to figure out what's worth following up on and what can be safely discarded.

But sandsifter just deals in discovery, and (in this case) to a very rudimentary extent - sandsifter was designed to find oddness in x86 CPUs, not entirely new processor architectures!

I am very interested to find out how you went from "hmm, that's weird" to pinpointing/establishing the very existence of the coprocessor, to identifying 21 of its instructions - and the x86 wrappings!

Also, in the same way a fighter pilot might share how to start up and fly an F-18, would you mind sharing how work on the assembler could be furthered by anyone with a VIA C3 who's interested in playing with this beyond going "huh, it's vulnerable"?

Please tell us that research papers and/or in-depth blog posts are in the pipeline. :)

And thanks, too. This is really awesome. ME, eat your heart out.

@brundage
Copy link

This is how I found my way here.

Looks like it all started with a patent search.

@ajxs
Copy link

ajxs commented Feb 26, 2019

In this video Mr Domas details his methodology and answers some of your questions above: https://youtu.be/_eSAF_qT_FY
It has been pointed out elsewhere that the DEC(sic) has been documented elsewhere in leaked proprietary documents. An online search for via C3 ALTINST should yield some useful results.
Not to detract in any way from Mr Domas' research, the video presentation detailing his methodology is simply amazing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants