0
\$\begingroup\$

I need to find a way of observing (on another 'monitor' machine) changes to registers critical to the address translation process on x86 platforms - including IDTR, GDTR, CR3, etc. This monitoring needs to be in real time, in the sense that any malicious changes must be observed.

Have considered hardware debugging, but this may be not feasible. What I would like to know is whether it is possible/feasible to extract information directly from hardware registers via a probe. I want to suggest, in my thesis, probing the instruction register, so that all instructions executed can be analysed on the external monitor, and use this to determine whether the instruction modifies one of these other registers.

Sorry if my question is vague, but can someone explain whether it is possible and if so how to capture values from registers in hardware (not at the software level) and in real time. All I know is that registers use 'flip flops' for storage of bits. How do I send notifications of changes to the value of these registers/bits to another device - not including any methods involving software on the machine in question?

\$\endgroup\$
1
  • \$\begingroup\$ Are you sure you can't do this in emulation? Or in a hypervisor? Otherwise I'm fairly sure the answer is no. \$\endgroup\$
    – pjc50
    Jul 14, 2015 at 12:48

1 Answer 1

4
\$\begingroup\$

You can't physically probe the registers on a modern chip. I don't think this is possible even if you have the absurdly expensive clean room and scanning-tunneling microscope required for probing it with the lid off; they're likely to be under too many metal layers.

I don't think the hardware debugging capabilities are sufficient for this either. You might be able to get at the registers over JTAG: http://www.newelectronics.co.uk/electronics-news/jtag-based-embedded-debugger-is-first-for-intel-x86-platforms/32720/ but not in "real time", you'd have to single-step the execution.

There is the under-documented "System management mode", which is a hardware hypervisor, but again I don't think that has the right "trap" capabilities to trigger on modifications to specific registers.

I've found your other question at https://stackoverflow.com/questions/31104228/in-ia-32-assembly-language-can-idtr-gdtr-or-ldtr-be-modified-or-loaded-witho , BTW.

The only way you could do this would be to build a "soft core" processor in an FPGA, which would be much slower than a real processor but faster than an emulation, and then you can monitor whatever changes you want.

\$\endgroup\$
4
  • \$\begingroup\$ Thank you, very helpful! This confirms what I was thinking, unfortunately. I have almost no knowledge of FPGA, however do you think the performance of a soft core processor would be sufficient enough for real deployment (keeping in mind that the purpose of capturing these updates in the first place is for a prevention of a specialised type of rootkit in an external monitor - these types of security monitors are usually only deployed in very critical systems where integrity is critical i.e. in cloud or in military systems)? \$\endgroup\$ Jul 15, 2015 at 15:13
  • \$\begingroup\$ For that kind of system, the usual solution is hypervisors, possibly in conjunction with advanced memory protection systems. E.g. ARM TrustZone plus the SEL4 microkernel, as used in both newer iOS devices and this drone platform: ssrg.nicta.com.au/projects/TS/SMACCM For military purposes, you could build custom silicon with whatever internal snooping system you want at full speed. \$\endgroup\$
    – pjc50
    Jul 15, 2015 at 15:30
  • \$\begingroup\$ The problem with hypervisor solutions is that a sophisticated attacker can escape the virtualised environment, such as a 'VM escape' or 'hyperjacking' type attack. This includes SMM or other firmware based security monitors, which have also been shown to be vulnerable. This is why some newer security systems are deployed on external, independent hardware since it is physically 'tamper-free'. This is essentially the motivation, however I am having a hard time finding a feasible way to generate real time notifications of register updates. \$\endgroup\$ Aug 1, 2015 at 15:04
  • \$\begingroup\$ But your comments were very helpful, a million thank yous :-) \$\endgroup\$ Aug 1, 2015 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.