Behind the Scenes of Intel Security and Manageability Engine
summary
Deep dive into CSME internals: architecture (1.5 MB SRAM, ROM immutable, DRNG, SKS hardware slots), secure boot chain with ROM-derived chipset keys, anti-rollback (CSME12 physical check), and field updates with version checks. Practical fuzzing/coverage work: implement ASan in silicon, modify GCC and per-process instrumentation, adapt AFL (including an AFL bitmap fix) and a feedback/queue manager to find paths. Runtime hardening includes XOR stack canary, end-branch CFI, privilege reduction for bring‑up, and verified mitigations.
AI-written summary · about
chapters (40)
- 0:00Introduction
- 1:37Jen
- 4:43Hardware
- 7:47PCH
- 10:55ROM
- 13:07Key Generation
- 14:24Secure Key Storage
- 22:53Kernel
- 24:22TCB
- 25:46BringUp
- 27:04Driver
- 27:41Application
- 28:27Auditing Mitigation
- 28:51Micro Kernel Architecture
- 30:38Micro Kernel Example
- 33:19Ring Free Processes
- 33:35ReadOnly Page
- 34:01Secondary Protection
- 35:59Nonlinear Buffer Overflow
- 36:22Control for Integrity
- 36:45Memory Corruption
- 37:05End Branch
- 37:16EnbridgeUp
- 37:40Compare
- 39:16Segmentation
- 39:32Hardening
- 39:52Security Lifecycle
- 42:24GOpC
- 42:38Error Flow
- 43:16Changing the Address
- 44:00Inflating the Code
- 44:39Fuzzing
- 44:58FL Instrumentation
- 45:20FL Bit Sizes
- 45:58Pipe Memory
- 46:59Test Cycle
- 47:15Test API
- 47:44Manufacturing
- 49:44Manageability
- 52:19Summary
related talks
48mSGX Secure Enclaves in Practice: Security and Crypto Review
51mKeynote |The Microarchitectures That I Saw And The Ones That I Hope To One Day See
23mOverview and Recent Developments: seccomp and Small Linux Security Modules
18mCPU Security in the Context of RISC-V
16mSoK: 20 Years of Power, Privilege, and Peril in x86 System Management Mode
30mProactive Software Defense against Side Channel Attacks
53mBack To The Future With Platform Security
59mGetting Started with Embedded Linux Security