PIkit: A New Kernel-Independent Processor-Interconnect Rootkit
summary
A kernel-independent rootkit named PIkit modifies the DRAM address mapping table in multi-socket AMD and Intel servers to redirect physical memory requests so user-level code can read or write another node’s RAM without changing kernel code. Implementation uses physical-address discovery via proc/pagemap, allocates large contiguous ranges with hugepages, updates memory-mapped DMBASEx/TD registers, and performs stealthy writes using non-temporal writes. Authors demonstrate four attacks (crash, keylogger, credential overwrite → root, shared-library patch); prototypes work on real AMD and Intel hardware.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:13Rootkit Classification
- 3:36Multi-socket (NUMA) Server
- 4:15Multi-socket Server Market Share
- 5:13Memory access in Processor-Interconnect
- 8:37High-Level Overview of Plkit installation
- 9:37Defining Attack Address Region
- 10:33Modifying DRAM Address Mapping Table
- 11:39How to modify DRAM Address Mapping Table
- 12:51Example - AMD Opteron 6128 server
- 13:47Extending Plkit to Intel Architecture
- 14:41Modifying TAD
- 15:24Possible Attacks
- 16:11Overview of Bash Shell Credential Object Attack
- 16:48Scanning the Fingerprint
- 18:39Overview of Shared Library Attack
- 20:59Possible Solutions
- 22:17Conclusion
related talks
01h 03mret2dir: Deconstructing Kernel Isolation
41mUsing Microarchitectural Design to Break KASLR and More
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming
50mMPK/PKS Linux Kernel Compartmentalization
40mWindows Kernel Patch Protection - Achilles Heel: PatchGuard
19mEPK: Scalable and Efficient Memory Protection Keys
40m(P)FACE into the Apple core and exploit to root