unlock SMRAM of AMD Processor

1. Unlocking 0 bit of HWCR register (MSR 0xC001_0015) in BIOS

2. Checking the SMM_BASE, and disable ASeg bit (0 bit)

SMM_BASE (MSR 0xC0010111h): check smm base if it is 0xa0000

SMM_MASK (MSR 0xC001_0113h): disable ASeg for unlocking SMRAM

3. Set MtrrFixDramModEn (bit 19) in SYSCFG register (MSR 0xC001_0010h)

It enables modification of RdDram and WrDram bits in fixed MTRRs 

4. Set the RdMem (bit 4) and WrMem (bit 3) bits of Memory Range Type Reigster MTRRfix16K_A0000 (MSR: 0x259)

msr.lo=0x18181818

msr.hi=0x18181818

5. Set the  MtrrFixDramEn (bit 18) in SYSCFG register (MSR 0xC001_0010h)

It enables read and write to RAM physical memory instead I/O mapped memory

6. Copy the binary code to 0xa0000

7. Enable the Aseg bit (0 bit) in SMM_MASK register (MSR 0xC001_0113h)

Reference: 

BKDG of AMD K8

step 4 needs to ee the “Memory Type Range Registers” section in Volume 2 of the AMD64 Architecture Programmer’s Manual for more information.

http://support.amd.com/us/Processor_TechDocs/24593_APM_v2.pdf


Ignore the above steps, use the updated version: 

First, you need an unlocked SMRAM, which means 0 bit of HWCR register is not set (MSR 0xC001_0015h)

1. Enable bit 19 and bit 18 of SYSCFG register (MSR 0xC001_0010h)
In my machine, the original value is 0x160601, and I set it to 0x1e0601

2. Set bit 4 and bit 3 of MTRR memory type range register (MSR: 0x259)
msr.lo=0x18181818
msr.hi=0x18181818
In my machine, the original value is 0, and I set it to 0x1818181818181818

3. clear bit 0 of SMM_MASK register (MSR: 0xC001_0113h)
In my machine, the original value is 1, and I set it to 0.

Latex draw diagram

Use tikz

http://tex.stackexchange.com/questions/8879/draw-image-data-flow

Heap Overflow Examples

Advanced Exploitation of Internet Explorer Heap Overflow (Pwn2Own 2012 Exploit)


http://www.vupen.com/blog/20120710.Advanced_Exploitation_of_Internet_Explorer_HeapOv_CVE-2012-1876.php


Huawei router Defcon Heap overflow exploit


http://phenoelit.org/stuff/Huawei_DEFCON_XX.pdf

Benchmark

Benchmark 1

Windows: PCMark
Download: http://www.pcmark.com/

Linux: UnixBench
Download: http://code.google.com/p/byte-unixbench/downloads/detail?name=unixbench-5.1.2.tar.gz&can=2&q=

Usage: ./Run


Benchmark 2

SuperPI

systester
http://systester.sourceforge.net/downloads.php

memory management in kernel

http://duartes.org/gustavo/blog/post/how-the-kernel-manages-your-memory

CentOS cannot boot

I had couple of times with CentOS cannot boot.

Please read my previous article about how to use Ubuntu LiveCD, and mount CentOS Volume group disk. Then you can change the grub.cfg file.

http://fengweizhang.blogspot.com/2011/02/mount-lvm-partition-from-other-disk.html

But it didn't work for this time.

I cashed CentOS again by adding mem=2000 to the boot argument in grub.cfg. Even I used first method, it cannot find any file in /boot directory.

This time I soved by using CentOS LiveCD. It has an rescue function, and install grub and configure boot flag automatic.

Heap Overflow Attacks

http://www.h-online.com/security/features/A-Heap-of-Risk-747161.html

http://heapoverflow.com/