Bay Trail, Intel's power efficient Atom x86 SoCs from 2013, ditched the previous ARCompact based management engine with the so-called TXE, with a *SPARC V8* core. Similar firmware, similar functionality, different ISA.
I wanted to gain access to one of these weird TXEs to dump its boot ROM, run my own code on it and study its peripherals and security model.
After many hours of trying to blindly exploit heap overflows in the firmware, I've found something infinitely better.
TXE has a limited amount of on-die SRAM, during boot it asks the host CPU to allocate some DRAM (so called UMA) for its working set, which gets isolated from the host CPU.
The isolation is *not* set by the TXE itself but the host MRC code, and as it turns out not setting it does not bother TXE at all, in fact it makes the TXE's working set visible to host in *plain text*.
13 year old hardware, but still this is one of the biggest wtf vulnerabilties I have ever seen, what a fail.