Spaghettifying DRAM
Points and comments are a snapshot, not live.
Flipping one bit in an AMD DRAM controller exposes all protected memory regions.
Christopher Domas's skitter-creek-bath-salts exploits DRAM controller address translation on AMD Family 16h CPUs to bypass memory protections. The controller's bank-swizzle register can be toggled from ring 0, scrambling physical-to-DRAM address mappings. By temporarily flipping one bit, an attacker can read Platform Security Processor firmware, System Management Mode memory, CPU microcode, and C6 DRAM. The attack relies on the fact that the memory controller's transform is a linear GF(2) map, allowing reconstruction of aliases that reach protected regions.
What commenters are saying
Commenters recognize Christopher Domas as a legendary hardware researcher whose past work uncovered undocumented x86 instructions and demonstrated novel reverse-engineering techniques. Many express disappointment that the README appears LLM-generated, contrasting with his earlier clear writing. A key technical clarification: this works on AMD Family 16h only; Zen (Family 17h) uses a different controller (UMC) with no public documentation. A KVM escape seems unlikely since guest VMs lack access to DRAM controller registers. Two commenters noted that Claude and Opus refused to discuss the exploit, while Sol handled it without issue.