DRAM scrambling unlocks PSP, SMM, microcode on AMD CPUs
Original: Spaghettifying DRAM
Why This Matters
Demonstrates a low-level hardware security bypass affecting AMD CPUs with implications for firmware and platform trust models.
Security researcher xoreaxeaxeax released 'skitter-creek-bath-salts,' a tool that manipulates AMD CPU DRAM controller address translations to expose protected memory regions, bypassing PSP, SMM, C6 DRAM, and microcode protections on AMD Family 16h processors.
Security researcher xoreaxeaxeax published 'skitter-creek-bath-salts' on GitHub, a proof-of-concept tool that exploits AMD DRAM controller address translation registers to 'spaghettify' memory mappings. By modifying the bottom layers of the memory hierarchy, the tool rewires physical DRAM address translations, scrambling platform memory and exposing protected DRAM carveouts that are invisible even to the operating system kernel.
The technique unlocks AMD's Platform Security Processor (PSP), System Management Mode (SMM), C6 DRAM regions, and CPU microcode. The project was developed and tested specifically on AMD Family 16h CPUs — the last generation whose datasheets publicly document the DRAM controller's translation registers and confirm they cannot be locked.
According to the project README, AMD Family 17h and later processors omit this information from public documentation, though the researcher notes the underlying memory address transform principles extend to ARM, RISC-V, and other architectures. The repository has received 483 stars and 55 forks since publication.