Capturing x86 register value changes in hardware i.e. at circuit level

Question

I need to find a way of observing (on another 'monitor' machine) changes to registers critical to the address translation process on x86 platforms - including IDTR, GDTR, CR3, etc. This monitoring needs to be in real time, in the sense that any malicious changes must be observed.

Have considered hardware debugging, but this may be not feasible. What I would like to know is whether it is possible/feasible to extract information directly from hardware registers via a probe. I want to suggest, in my thesis, probing the instruction register, so that all instructions executed can be analysed on the external monitor, and use this to determine whether the instruction modifies one of these other registers.

Sorry if my question is vague, but can someone explain whether it is possible and if so how to capture values from registers in hardware (not at the software level) and in real time. All I know is that registers use 'flip flops' for storage of bits. How do I send notifications of changes to the value of these registers/bits to another device - not including any methods involving software on the machine in question?

Answer 1

You can't physically probe the registers on a modern chip. I don't think this is possible even if you have the absurdly expensive clean room and scanning-tunneling microscope required for probing it with the lid off; they're likely to be under too many metal layers.

I don't think the hardware debugging capabilities are sufficient for this either. You might be able to get at the registers over JTAG: http://www.newelectronics.co.uk/electronics-news/jtag-based-embedded-debugger-is-first-for-intel-x86-platforms/32720/ but not in "real time", you'd have to single-step the execution.

There is the under-documented "System management mode", which is a hardware hypervisor, but again I don't think that has the right "trap" capabilities to trigger on modifications to specific registers.

I've found your other question at https://stackoverflow.com/questions/31104228/in-ia-32-assembly-language-can-idtr-gdtr-or-ldtr-be-modified-or-loaded-witho , BTW.

The only way you could do this would be to build a "soft core" processor in an FPGA, which would be much slower than a real processor but faster than an emulation, and then you can monitor whatever changes you want.