0
\$\begingroup\$

Edit: I think using the term "bus" might be wrong here. A "bus" needs to be large enough to facilitate an entire DDR4 stick's bandwidth to the Northbridge. The connection to each individual pin probably doesn't count as a "bus", maybe "pin" in the right term?

I'm sure data busses and pins differ in size, I suspect depending on how much current needs to flow through them. Household foil is roughly 0.016 mm thick. Can a connection pin between RAM and the motherboard be that thin?

Since this is an odd question that depends a lot on the scenario, probably, I'll explain the context. I'm starting to get my feet wet on the subject of computer engineering purely for the reason that I want to prove an idea is possible. So I decided to just try it. Worst case scenario I try something too difficult and learn something in the process. My idea is a micro-controller which physically intercepts the DDR4 RAM slot of a desktop PC with a thin sleeve. Like so:

enter image description here

Figure 1: Interceptor Sleeve, a paper-thin layered sleeve sits between the RAM slot and the motherboard. Normally, the Interceptor sleeve completes the connection between the RAM stick and Motherboard without interference. However, a transistor along this connection allows frames (or whatever they're called with busses to DDR4, I'm only familiar with the simpler CAN bus so far) from the motherboard to be conditionally intercepted by and replied to artificially, without passing the frame further. Likewise, while connections from the motherboard are being are being intercepted for a specific address range, the Interceptor can send its own frames over the RAM connector to read or write. In this way, the system can read and write to specific memory ranges while allowing

I only plan to test this with one single pin on the RAM at first.

Nevertheless, I grabbed a powered down mobo and RAM and found that three layers of foil could fit between an inserted RAM stick and the connection. So if a bus/pin can be as thin as tinfoil, those three layers should be the equivalent of a pin, insulator, and the other "side" of the pin as shown in Figure 1.

\$\endgroup\$
11
  • 1
    \$\begingroup\$ You also have capacitance issues. \$\endgroup\$
    – DKNguyen
    Sep 4 at 19:43
  • 2
    \$\begingroup\$ @J.Todd You have a high-speed bus, running at hundreds-thousand of MHz; any stray capacitance at any node is going to severely load it (current destined for the other end gets shunted through the capacitance). \$\endgroup\$
    – nanofarad
    Sep 4 at 19:47
  • 1
    \$\begingroup\$ The slowest DDR4 bus has data signals running at 800 MHz - on both clock edges so 1600 MT/s. Fastest rates go to 1600 MHz so 3200 MT/s. The wiring needs to approximately be matched to 0.5 millimeters. This is not a job for microcontroller. Why do you want to intercept a single data bit, what would be the purpose of it (simply to rule out issues with XY problems)? \$\endgroup\$
    – Justme
    Sep 4 at 19:50
  • 1
    \$\begingroup\$ This is borderline infeasible at DDR4 speeds. Building a device that acted as a second DIMM in a two slot per channel system and injected rouge commands would be a lot easier though since then the system is at least designed to have two things on the bus. \$\endgroup\$ Sep 4 at 20:07
  • 4
    \$\begingroup\$ In addition to what @justme said, your little drawing is in itself a capacitor, with the two conductors and a very thing insulator in between. It's not going to entirely block the signal and what gets through might be enough to muck up the works. \$\endgroup\$
    – DKNguyen
    Sep 4 at 20:08
3
\$\begingroup\$

A connector can be that thin, and in fact the card edge connectors on DIMMs are extremely thin: According to this manufacturer, their hard gold plated connectors are likely on the order of 30 microns (for 1 oz copper) plus around 3-6 microns nickel followed by 1-2 microns of gold.

However, there are other issues with your design - your drawing shows an unrealistic mechanical situation with the interceptor with two parts hitting head-on, while in the card edge connector, the connector slides over the plated contact on the board.

Furthermore, there's a much larger issue - the electrical design of your interceptor. DDR4 handles signals at clock frequencies of nearly 1 GHz (and correspondingly higher harmonics/double-edge data signals). In this situation, every bit of wire you add acts in some way like an antenna, reflection, etc unless the wiring geometry is precisely controlled to provide a consistent transmission line impedance.

Furthermore, the pins are combined in groups that all share clocks, meaning that you can't just interact with one line - you'd need to interact with a pair, while maintaining their relative geometry, matched path lengths, etc. Otherwise, you'll introduce unacceptable clock skew on whatever data or address line you chose as your victim.

Even if you did intercept just one pin (and its differential pair partner), you don't get much info and would need to intercept the clock and other pins to make sense of it; simply knowing that at 3.1415926 seconds after startup, the fourth data pin was '1' rather than '0' doesn't tell you anything if you don't have the address and operation in question.

If you really want to do this, you'll need to degrade memory timings significantly, and you may as well just put an entire adapter in-line, which has impedance-controlled wiring, and socket, and any interceptions you care about, run to high-speed pins on a suitable chip (likely a high-end FPGA). A microcontroller won't cut it - microcontrollers generally don't have their core logic clock running at 800 MHz, let alone have I/Os that can sample on both rising and falling edges of such a fast clock.

\$\endgroup\$
7
  • 1
    \$\begingroup\$ "every bit of wire you add acts in some way like an antenna" wow this field is hard. I thought software bugs were hard, jeez. \$\endgroup\$
    – J.Todd
    Sep 4 at 19:47
  • 3
    \$\begingroup\$ @J.Todd It's a lot more friendly at lower frequencies. If you're just looking for a proof of concept or to play around with this kind of stuff, consider trying a smaller+slower embedded system that might use a bit of external memory, and try interacting with that first. A lot of such systems also have simpler protocols which you'll be able to make sense of more quickly, and are also cheaper+more robust in case you make a wiring mistake that could cause hardware damage. \$\endgroup\$
    – nanofarad
    Sep 4 at 19:49
  • \$\begingroup\$ Tyty, I will try that. This sounds like something you study for 4-8 years to speak intelligently about it. I'm a soldier thinking of pitching this to the Army for R&D as a way to inject kernel scanning code into a TRGN generated random memory location and using JTAG to escalate to kernel-mode, and send the instruction pointer to that location for scanning (to make it impossible for the ring 0 attacker to compromise the integrity of the scan scan and overwrite results). Would you do me a favor? Could you give me your opinion on whether this kind of device can be produced (by professionals)? \$\endgroup\$
    – J.Todd
    Sep 4 at 19:56
  • \$\begingroup\$ When I'm trying to pitch a hard thing I think people will disagree is possible, I want to go the extra mile to prove the tech, but it sounds so incredibly complex that in this case I might just have to settle for "this is probably possible, let a team of engineers decide, and if so, we can do XYZ capability with it". But if there's no chance in hell of it working, I don't want to waste anyone's time. \$\endgroup\$
    – J.Todd
    Sep 4 at 19:59
  • 1
    \$\begingroup\$ @J.Todd I don't have experience on the manufacturing side, so I don't know what's possible. I know that if you design your own memory DIMMs, you can include interception logic as long as you have a fast enough processor/FPGA you control (physically located on that DIMM), making the physical pin interceptor design irrelevant. I don't know the complexities of JTAG well enough here, but I'm convinced that if you are dealing with a software attacker, you can probably write to memory through the JTAG interface anyway, and if you are going up against an adversary's hardware they don't need to... \$\endgroup\$
    – nanofarad
    Sep 4 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.