David BuchananOct 2, 2024
If you solder a ~10cm long "antenna" wire to a laptop's DRAM data bus, it makes it extra sensitive to electromagnetic interference.

So much so that clicking a piezo-electric arc lighter nearby can induce bit-flips.

I wrote an exploit to turn those bitflips into a shell:
Show threadDavid BuchananOct 2, 2024
PoC source: https://github.com/DavidBuchanan314/dram_emfi/blob/348bd15c9e767bff5968a4fcc80a97b81dc63bda/ddr3_dq7.py
dram_emfi/ddr3_dq7.py at 348bd15c9e767bff5968a4fcc80a97b81dc63bda · DavidBuchanan314/dram_emfi

playing with DDR DRAM bus fault injection. Contribute to DavidBuchanan314/dram_emfi development by creating an account on GitHub.

GitHub
Show threadDavid BuchananOct 2, 2024
I'm exploring this because I think it might be useful for console hacking - where you have physical access, and the ability to execute sandboxed code (say, inside a web browser)
Show threadRairii (bootloader unlocked, MSR_LE set)Oct 3, 2024
@retr0id don't consoles tend to have some form of hardware ram encryption?
Show threadDavid Buchanan
@Rairii possibly, I'll be finding out how the nintendo switch reacts to it shortly
Oct 3, 2024 at 1:01pmWeb
Show threadMethylzeroOct 3, 2024
@retr0id @Rairii Yeah I think all of the AMD SOCs have transparent RAM encryption
Show threadAlonely0 🦀 🇪🇺Oct 4, 2024
@Methylzero @retr0id @Rairii the switch has an Nvidia chip.
Show threadSaagar JhaOct 6, 2024
@retr0id @Rairii We’re kicking grandpa over here are we