liffik

7 ms·

1.
by liffik 2mo ago
Thanks for the incredibly constructive feedback! This is extremely helpful. The jmp short + nop header and adding the cld instruction are excellent points. I will add those to the bootloader right away to ensure better BIOS compatibility an
2.
by liffik 3mo ago
Booting a tiny Linux kernel would overwrite way too much RAM, destroying the exact data (like crypto keys) we want to recover. That's why my bootloader is strictly 512 bytes to minimize the footprint. As for the shim bootloader: it onl
3.
by liffik 3mo ago
Guys, it’s just easier for me to communicate via AI because I don’t speak English I’m using a translator right now. Everything I described (including the AI part) is real, and the method works too; I’m just lazy. I used this software on som
4.
by liffik 3mo ago
Ah, I see what you mean! You are totally right, the physical execution is the truly interesting part. To clarify, I actually didn't swap the RAM modules to another system. Moving cooled RAM is incredibly difficult and leads to rapid da
5.
by liffik 3mo ago
@Retr0id is absolutely right. Hardware-level memory encryption (like AMD SME or Intel TME) is the ultimate silver bullet here. The encryption key is generated by the CPU/memory controller per-boot and is lost the moment power is cut, m
6.
by liffik 3mo ago
Right
7.
by liffik 3mo ago
You are absolutely correct, and I highly appreciate the clarification! I definitely misspoke in my previous comment. CSM doesn't magically bypass an active Secure Boot state. Rather, to even boot via CSM, Secure Boot typically must be
8.
by liffik 3mo ago
Spot on! That is exactly why I chose the legacy 16-bit method via CSM. It was a deliberate design choice to completely avoid the EFI bootloader and, consequently, bypass Secure Boot entirely. By relying on Legacy BIOS, the system doesn&#x27
9.
by liffik 3mo ago
Sure! The testing was conducted on a specific industrial x86 board (DPX-W250 Rev. A1). I won't go into details about the exact equipment it came from, but it provided a perfect bare-metal environment for this research)))) The testing p
10.
by liffik 3mo ago
Good point! I originally went with Legacy BIOS because 16-bit boot support is historically enabled by default on the vast majority of target machines out there. It keeps the bootloader tiny and hardware access as direct as possible. However
11.
BareMetal RAM Dumper – Bare-metal x86 tool for Cold Boot Attack experiments(github.com)
72 points by liffik 3mo ago|44 comments
12.
by liffik 3mo ago
Hey security researchers! I've released BareMetal-RAM-Dumper — a low-level x86 utility for dumping physical RAM directly to disk, designed for Cold Boot Attack research. What it does: • Custom 512-byte bootloader (no OS needed) • Boot