| > But you’re really getting what the memory controller decides to give you. Yes, here the memory is read through a debug bus. > I could design a memory controller with landmines, as in “if you ask for 0x1234 I will go into a mode where I send back garbage for all future reads until power is cycled.” Yes, it basically looks like a backdoor, and you can do it the other way around:
The memory read through the debug bus is exactly the content of the ROM, but the memory controller is made so that when the processor reads a specific address or data it doesn't return the value in memory but something else. This way even a person who would use a visual or an intrusive memory extraction method would not notice the backdoor.
The only way to discover it is to do a full inspection of the logic, which probably nobody will do. > Is this a thing? Yes, sometimes some addresses in a memory system are effectively not readable (write only).
As for example with some memory-mapped configuration registers, a 0-value may be returned instead of the register contents. But your question sounds to me more about mechanisms to hide a backdoor. Regarding hardware backdoors, they are always theoretically and practically possible, and almost always undetectable.
Since nothing prevents the designer from introducing logic that has malicious behaviour and it's nearly non-observable. This is the problem with theories about backdoors in modern processors.
Without evidence, these theories fall into the realm of conspiracy theories.
But it's almost impossible to have evidence and no-one can say that it doesn't exist. |
except for intel, if they publish how their hardware and microcode works internally? aka, opensourcing their internal design?
Of course, they can't since it will allow competitors to copy it, but would that work theoretically?