4
\$\begingroup\$

I wonder if it is possible to modify a consumer electronic system (TV, phone, embedded device, etc.) so that it is possible to read and possibly write the contents of its RAM chips while system is running, without adding any software to the target device.

I'm not very familiar with hardware, but I guess a solution could possibly involve soldering something on the pins of the RAM chip, so that signals are intercepted, and then "replaying" the writes to an internal RAM, effectively creating a synchronized copy of the device RAM.

The internal RAM could then have a second port that would allow the user to read it, for example via a controller exposing an USB mass storage interface.

Alternatively, without the second port, the controller could perhaps give the original device access to the internal RAM when it is writing, and instead replace reads with the reads issued by the user to examine the RAM when it is reading.

Or for DRAM chips refreshed by the controller, it could filter out all access except writes used for DRAM refresh (by detecting a refresh and then using a timer), and then pass examination reads at times when DRAM refresh is not happening.

An alternative design could be to replace the RAM chip with a dual ported RAM, and then wire the original port to the target device, and the other port to the controller allowing to read or write it.

This latter design would also allow to write the RAM in addition to reading.

Alternatively, one could maybe attempt to process the stream of RAM signals in software instead of sending it to a RAM chip, but it seems this would be far more complex and expensive due to the high data rate (which might require splitting the stream and processing it with a cluster of machines).

Precisely, the questions are:

  1. Is it possible at all?

  2. Is it feasible to do this on commercially produced motherboards with soldered RAM chips found on consumer electronic devices?

  3. Are there any off-the-shelf devices that can do this?

  4. If not, what would be the cheapest/simplest way of building a single copy of such a device with only read support? What about write support? (assuming everything beyond the target device and a normal PC has to be bought)

This is a general question regarding SRAM, DDR, LPDDR, GDDR, Rambus, etc. chips.

\$\endgroup\$
5
  • 2
    \$\begingroup\$ A good number of consumer electronic devices don't even use discrete RAM chips. \$\endgroup\$
    – Ignacio Vazquez-Abrams
    Feb 24, 2014 at 0:46
  • \$\begingroup\$ Do you mean that the CPU/SoC and RAM are on the same chip? I'm asking about those where this is not the case, and there are individual RAM chips on the motherboard. \$\endgroup\$
    – chippy
    Feb 24, 2014 at 0:51
  • 1
    \$\begingroup\$ The approach used here may be of interest - scanlime.org/2009/09/dsi-ram-tracing. As I understand it on the 'read' side she sniffs the memory bus and from that can re-construct the RAM contents at any time (not necessarily in real-time) and on the write side she does a 'man in the middle' type attack by disabling the RAM's chip select when reads from certain addresses are seen and then driving the bus to whatever value is desired. \$\endgroup\$
    – Matt B
    Feb 24, 2014 at 6:01
  • \$\begingroup\$ @IgnacioVazquez-Abrams - those would generally only be the smallest systems. Anything that needs megabytes of memory is going to use external RAM, though in some cases today that might be in a package-on-package format. \$\endgroup\$
    – Chris Stratton
    Feb 24, 2014 at 16:23
  • 1
    \$\begingroup\$ A jump-out concern with the question itself would be the probability of an on-chip cache. This would slightly complicate monitoring of reads, but make execution tracking and data substitution very tricky. \$\endgroup\$
    – Chris Stratton
    Feb 24, 2014 at 16:24

1 Answer 1

Reset to default
1
\$\begingroup\$

Is it possible at all?

Well, maybe yes.

Is it feasible to do this on commercially produced motherboards with soldered RAM chips found on consumer electronic devices?

Definitely no. Connecting wires to the lines between the CPU and the RAM without disturbing communications is extremely difficult. The faster the bus is, the more difficult this is. Replacing the RAM chips with something (a larger FPGA + external RAM would probably suffice) that "simulates" a RAM chip to the modified system and does whatever you want with the data is probably a lot more feasible.

Are there any off-the-shelf devices that can do this?

Most probably no.

\$\endgroup\$
3
  • \$\begingroup\$ Wouldn't replacement have the downside of introducing extra latency, which could possibly be enough to make the memory controller give up, or otherwise detectably alter the target timing behavior? Also, if connecting wires is not feasible, would detecting the magnetic field generated by current in a motherboard trace perhaps be more feasible? (I guess not, but no idea) \$\endgroup\$
    – chippy
    Feb 24, 2014 at 2:01
  • 1
    \$\begingroup\$ @chippy: It generally wouldn't make the device "give up"; most RAM devices will be expected to have supplied data within a certain length of time after receiving a request, and will be assumed to have put valid data on its output pins. If there's too much latency, it won't be able to. On the other hand, if one adds 3ns of latency with the intercept, one may be able to use a RAM chip that's 3ns faster than the one originally in the circuit to compensate. \$\endgroup\$
    – supercat
    Feb 24, 2014 at 3:44
  • \$\begingroup\$ @chippy: If you put the "replacement" near enough to the connection points, you can make the extra latency quite small. A few cms should not cause problems (30cm = 1ns). Magnetic field detection in the range of several 100 MHz sounds like a very rough road to me. \$\endgroup\$
    – Laszlo Valko
    Feb 24, 2014 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.