Breaking the x86 Instruction Set

A processor is not a trusted black box for running code; on the contrary, modern x86 chips are packed full of secret instructions and hardware bugs. In this talk, we'll demonstrate how page fault analysis and some creative processor fuzzing can be used to exhaustively search the x86 instruction set and uncover the secrets buried in your chipset.

Full Abstract & Presentation Materials:

[ppp]

This guy is impressively good at what he does.

[tspshilt]

The use of No Execute on memory to find instruction length made me go "oh man" out loud. Genius.

[NiKi-hlzs]

Oh man, that page fault analysis is genius.

[JDManring]

I am jealous. Not only is this guy much more capable of mentally processing this complex information than I am, he's also incredibly good at presenting it!

[wildwest]

its kind of scary how good some of these guys are at figuring these things out

[wiipronhi]

they should crowdsource the undocumented instructions the same way that pass mark gets benchmarks. Everyone uploads the results and a website shows a nice breakdown of what instruction run on what.

[axeman]

I just keep thinking how poor Terry Davis has wasted all his time.

He needs to make his own silicon as well as his own compiler and OS.

[TheOz]

With Intel's ZombieLoad, PlunderVolt, Meltdown and more severe vulnerabilities these days, this video is more relevant than ever

[desmond-hawkins]

It looks like the "halt and catch fire" instruction he describes starting at 38:46 was never described publicly, at least that I could find. As he explains in this talk there was no time for vendors to address the issue under responsible disclosure so he couldn't give all the details at Black Hat 2017, but I couldn't find any reference to publications in the following months as he said would happen. There's a question about it on the Reverse Engineering StackOverflow site, but no one seems to know. I'm not particularly looking for a way to execute this instruction, but I'm curious to know if any mitigation was possible for CPUs that had already shipped. If anyone knows and has a reference this would be much appreciated.

[ShadyNetworker]

Goddamn, did Intel send assassins after this guy or what?

[sangamo]

My god that page fault technique is so awesome. So clever

[kosta]

I should imagine a lot of these undocumented instructions would be work in progress, perhaps left there for eventual future use, perhaps used to reduce the cost of prototyping, but the coordination between x86 manufacturers does raise some serious concerns. These could be anything from hyperoptimised inverse square root calculations to deliberate holes in x86 security, put in place for "the right people"... See "idiocy of back doors"...

It could also be as simple as Micro$oft (or Apple?) paying them a handsome sum of money to implement a custom instruction set just for them without telling anyone.

[ruthlessadmin]

This is why open source is so important. I would love to see a viable open CPU alternative emerge, on the scale of Linux in the software world. It's not impossible, but it would be a much different and more challenging problem to solve.

[ehsnils]

Really good. Having done some Z80 programming once upon a time I know that some undocumented instructions are merely side effects of the microcode and not necessarily intentional. But the point is to figure out the instructions that really are intentional and undocumented.

Unintentional undocumented instructions could of course be fun too if you want to do some "smart" programming, but don't expect them to work in the next generation of processors.

[kopuz.co.uk.]

It's good to see Black Hat uploading videos unlike the other popular tech conference.

[bkiffter]

Maybe a stupid question, but how does the cursor keep blinking if the CPU is locked up?

[JasonMasters]

Undocumented instructions have been around at least since the Z80 and perhaps before then. This is an 8-bit CPU which uses a separate 16-bit address bus.

The Z80 has two 16-bit index registers, IX and IY, intended solely for indirectly accessing memory, but people noticed that the binary code for accessing these registers was just one byte to say "Use IX" or "Use IY" followed by exactly the same instructions used to access the HL register pair, which are two 8-bit registers which can be used together as a 16-bit address.

Since the H and L registers can be used as separate 8-bit registers, people decided to try adding the "Use IX" or "Use IY" byte in front of the 8-bit H or L register instructions and discovered that they could access IXH, IXL, IYH and IYL as 8-bit registers.

Many programmers then wrote an include file which defined these undocumented instructions as macros so they could use them directly in their programs.

[edmund-osborne]

Finally! Someone speaking at a tech event who isn't a stuttering incompetent mess onstage!

[rogerflores]

A brilliant talk showing persistence and out of the box thinking. As pointed out, the time is well past for trusting the docs of closed hardware designs!

I need to go now and think about working the ideas into my disasm and emulator.

[jemakrol]

This is so well done in every aspect. There are smart people and there are people like this, that goes beyond that. Well performed presentation.
As of 2021 I find surprisingly little follow up info on that Halt and Catch Fire instruction - dunno if that's me sucking in searching or that the disclosure still apply.