Persona: Senior Hardware Security Researcher & Embedded Systems Analyst
Abstract:
This technical presentation details a multi-vector attack on the AMD Platform Security Processor (PSP), the hardware Root of Trust (RoT) for Zen 2-based SoCs. Initially targeting a commercial gaming console to enable custom software execution, the research shifted to a cheaper, functionally identical desktop "spinoff" mainboard. The analysis uncovered a Time-of-Check Time-of-Use (TOCTOU) vulnerability in the off-chip bootloader's SPI flash handling, allowing for arbitrary code injection via a Raspberry Pi Pico-based "modchip."
By exploiting memory-mapped I/O (MMIO) access and the Crypto Co-processor (CCP), the researchers elevated privileges to EL1 and implemented a novel ROM dumping strategy involving chained DMA transfers and CPU warm resets. Further investigation into the extracted ROM revealed a logic flaw in the FIQ (Fast Interrupt Request) handler related to banked register clearing. The talk also introduces a sophisticated hardware glitching technique that "smartifies" dumb voltage regulators by manipulating the feedback loop to achieve precise undervolting without removing surface-mount capacitors. The research concludes with the successful decryption and patching of game assets following a parallel public jailbreak in the console hacking community.
Technical Summary: Circumventing AMD PSP Security and Achieving EL3/EL1 Execution
0:53 Target Selection & Pivot: The research focuses on an AMD Zen 2 SoC. Due to cost and firmware restrictions on the retail console, the researchers pivoted to a desktop spinoff board with the identical 8-core CPU and PSP architecture.
4:32 AMD PSP Root of Trust: The PSP is identified as a 32-bit ARM Cortex core embedded within the CPU, responsible for DRAM initialization and the secure boot chain. The boot flow progresses from the on-chip ROM to an off-chip bootloader, Agesa Bootloaders (ALs), and finally a Secure OS.
7:44 LPC Sniffing and Boot Observation: Researchers utilized an LPC bus sniffer to monitor post-codes, identifying specific boot stages and error states used to time exploitation attempts.
11:59 TOCTOU Exploit (The "Double-Read" Bug): A critical software bug was discovered in the off-chip bootloader where it reads the AL0 header/body twice—once for execution in SRAM and once for SHA verification. This allowed for an SPI injection attack using an RP2040 to provide a malicious payload during the first read and the legitimate binary during the second.
13:39 Privilege Elevation via CCP: Code execution was initially achieved in EL0 (sandboxed). By abusing peak/poke system calls and the Crypto Co-processor's (CCP) pass-through mode, the researchers overrode EL1 exception vectors to gain higher-level control.
16:05 LSB Key Extraction: The team analyzed the CCP’s Local Storage Blocks (LSB). While readout protection was present, they successfully extracted keys by exploiting byte-offset addressing to brute-force unknown key bytes from adjacent protected slots.
17:23 ROM Dumping Strategy: To bypass ROM readout protections, the team utilized a "warm reset" register found via MMIO brute-forcing. By chaining a DMA transfer with a CPU reset, they captured the ROM contents into SRAM, which persisted through a subsequent reboot for extraction.
23:52 ROM Logic Flaw: Analysis of the extracted ROM revealed a vulnerability in the clear_regs_and_stack function. In FIQ mode, registers R11 and R12 are banked; the function clears the "should panic" flag and boot address in the wrong bank, potentially allowing a jump to address zero (the off-chip loader) even during a panic state.
29:08 Voltage Regulator (VRM) Feedback Mod: A novel glitching method was developed using an OPA 354 op-amp to inject voltage into the feedback loop of the CPU's voltage regulator. This allows for precise, software-controlled undervolting and overshooting, bypassing the smoothing effects of on-board capacitors.
34:06 SRAMM vs. ROM Glitching: Testing confirmed successful glitching of code running in SRAM (targeting load/store instructions). However, the ROM proved more robust, likely due to a more resilient internal bus architecture.
40:15 Objective Achievement: Despite glitching hurdles, the primary goal was reached after independent public exploits enabled a console jailbreak. The researcher successfully decrypted, binary-patched, and reinstalled a modified version of Beat Saber with custom song maps.