xoreaxeaxeax/skitter-creek-bath-salts

What it solves

This project provides a method to bypass hardware-level memory protections on certain CPUs by manipulating the memory controller's address translation. It allows access to protected regions of DRAM—such as the Platform Security Processor (PSP), System Management Mode (SMM), and CPU microcode—that are normally invisible even to the operating system kernel.

How it works

The tool modifies the bottom layers of the memory hierarchy (the MCT/DCT layer) by flipping bits in the DRAM controller's translation registers. This "spaghettifies" or scrambles the physical address mapping, creating aliases that can reach protected memory cells without triggering the security fences that guard standard physical addresses.

Because the exact scrambling matrices are often undocumented or vary by model, the project uses the Z3 SMT solver to reconstruct the translation matrix. By placing sentinel values in memory and observing where they reappear after scrambling, the tool gathers data points to solve for the linear map (GF(2) linear algebra) that converts a coherent-view address to a spaghettified-view alias.

Who it’s for

Security researchers and low-level systems engineers interested in CPU architecture, hardware vulnerabilities, and firmware security, specifically those working with AMD Family 16h CPUs.

Highlights

• Bypasses Hardware Fences: Accesses memory regions like SMRAM and PSP private memory by operating below the level where security primitives are enforced.
• Linear Algebra Approach: Uses GF(2) linear algebra and Z3 to mathematically derive the memory scrambling transform.
• Low-Level Manipulation: Employs precise assembly-level timing and cache control (clflush, mfence, lfence) to scramble and restore memory mappings without crashing the system.
• Broad Applicability: While tested on AMD Family 16h, the underlying concepts of address translation transforms apply to other architectures like ARM and RISC-V.