Hacker News Reader

Comment by nomercy400 | Hacker News Reader

Wow, so providing a tool for bypassing the protection mechanism of a device (cpu) is accepted when it comes from google?

Try this on any game console or drm protected device ans you are DMCAed before you know it.

View on HN

We broke the "encryption" (more like scrambling) of the AMD K8 and K10 CPU microcode updates. We released tooling to write and apply your own microcode updates. AMD did not take any actions against us. Granted, this was a university project so we clearly were within the academic context, but we were in no way affiliated with a too big to sue company.

https://www.usenix.org/system/files/conference/usenixsecurit...

https://informatik.rub.de/veroeffentlichungenbkp/syssec/vero...

https://github.com/RUB-SysSec/Microcode

How much is there in common between the Zen cpus of the current microcode reverse-engineering compared to the K8/K10 you looked at?

I have not looked at the format of the microcode yet, so this is only based on the blog post and discussions. K8 and K10 were based on Risc86 just like Zen seems to be. There also are some parallels, especially when it comes to sequence words and branch delay slots. There are also major differences like moving from triads to quads. I assume there are quite some similarities, but the current authors are better qualified to answer this at this point.

> Granted, this was a university project so we clearly were within the academic context, but we were in no way affiliated with a too big to sue company.

Even without supposed goodwill of AMD and seeing things a different way being a) affiliated with a university b) outside the USA may have changed some of the equation.

Any encryption/signature that can be broken in software on affordable hardware is just that: BROKEN.

What is your theory of harm? Who is harmed and how? Why should the law protect them by restricting the freedom of others?

AMD *sold* these CPUs to customers potentially running this tool on their hardware. That makes you think AMD should be entitled to restrict what the public is allowed to know about their products or does with them post sale?

Also if AMD is still in control shouldn't they be liable too? Should users get to sue AMD if an AMD CPU got compromised by malware e.g. the next side channel attack?

I might start to feel some sympathy for AMD and Intel if they voluntary paid all their customers for the effective post-sale performance downgrades inflicted on customers by mitigations required to make their CPUs fit for purpose.

DMCA 1201 says ANY decryption without permission from a copyright holder (with some exceptions that are in practice pretty minor) is a federal crime. Yet one more on the pile of "three felonies a day" to hold over the masses to keep them in line.

If this was the case, reading your comment (when delivered over TLS in a relevant jurisdiction) would be one such crime.

It was decrypted on my authority as the author by virtue of whatever license the Hacker News TOS requires in order to store and transmit my posts to the public.

Are you talking about legalities? AFAIK Hardware jailbreaking/homebrew tools are fine even in jurisdictions blighted with with DMCA unless they're specifically for circumventing DRM.

If more about morals, generally publishing vulnerability research tooling is business as usual for white hat vulnerability researchers, working at bigcorps or not, and has a long history. seems surprising to see this kind of "not cool" comment on this site.

> AFAIK Hardware jailbreaking/homebrew tools are fine even in jurisdictions blighted with with DMCA unless they're specifically for circumventing DRM.

Certain Japanese video-game companies would take issue with that interpretation of facts. Of course there is the arbitrary distinction between 'access' and 'copy' control mechanisms. Something arguably made irrelevant by the further integration of general concepts from personal-computing into certain video-game systems.

We live in an age where it's okay to pirate terabyte of data if you're Meta.

‘In the courts, you will be deemed either innocent or guilty, according to your wealth or poverty.’

What a sad and anti-hacker mentality comment.

It's not who releases it, it's who is the target that makes the difference. AMD chooses not to sue the researchers, whereas a game console maker would probably sue.

Ok, but that's on "you" being braindead releasing something like that on github. Release it anonymously and DMCA paper becomes toilet paper.

Same with apps, aka everything is opensource if you know RE ;-)

only if it's a nintendo console :)

Nintendo just shut down some Github repos for lousy DRM claims:

https://github.com/github/dmca/blob/master/2025/02/2025-02-2...

Reply on news.ycombinator.com