@_markel___

I research security of Intel platforms. I don't work for Intel

 Москва, Россия
Joined September 2014
  • Tweets1.6K
  • Following134
  • Followers12.2K
309Media
Finally, the casket is opened: we (+@h0t_max and @_Dmit) have extracted Intel x86 microcode! One more Intel "top secret" information gets revealed... github.com/chip-red-pill/glm…
19
368
25
962
Be aware of potentially danger default settings for I2C SCL/SDA IO pins in Lattice Radiant (Open Drain mode is requred for I2C), as it isn't checked by Map and other tools generating a valid bitstream. This can lead to a damage of a driver even if the slave never sets 1'b1 on SDA
1
17
1,094
Alright, this is going to be fun...
31
1,460
Here is what the differential clock signaling actually looks like for Intel CPUs...
12
3
1
159
7,599
I’m so happy for our hardware Positive Labs (@ivannikovp and others), who are helping me with my Intel research. Together, we’re going to break Intel desktop CPUs!
3
5
72
3,696
Mark Ermolov retweeted
Ilya Andr@andrd3vSep 15
Missed one more from the drop lol CVE-2026-43783 - macOS LPE via DesktopServicesHelper. One XPC request -> arbitrary chown -> root. PT SWARM writeup: ptswarm.com/blog/cve-2026-43… My blog: andrd3v.github.io/cve-2026-4… PoC: github.com/andrd3v/CVE-2026-…

CVE-2026-43783: Repair Permissions – Get Root: LPE via DesktopServicesHelper in macOS 26.5

The daemon that Finder uses to “repair” permissions on iCloud files turned out to be willing to repair permissions on anything – including system directories. In this article we’ll look at how...

ptswarm.com
2
8
50
4,109
After 4 years of effort, I'm happy to announce that one of the final secrets of the PS2 has been broken wide open! It's been a long process of decapping, optical dumping, and now at last a software solution. Thank you Libby for finding the exploit from our dirty optical dumps!
109
684
18
7,647
366,450
Here is how the EREPORT SGX leaf signs the report
1
5
57
2,817
Anyone who has carefully read the Intel article on XuCode (intel.com/content/www/us/en/…) might well wonder: where (from which memory) MCHECK executes? (1/x)
2
2
21
2,210
more replies
It's not L2 or C6SRAM of CPU module, it's a completely different memory outside of CPU core used also to cache requests to memory controller (D-unit) from all agents including iGPU (5/x)
1
1
4
490
We think that desktop/server CPUs also have this 'February' memory and really want to read it )) (6/6)
5
398
Mark Ermolov retweeted
SKVLLZ.@xsh3llsh0ckSep 2
Looks like AMD supports "Red Unlock" too! I wonder how HSP_DEBUG_UNLOCK syscall really works ;)
3
7
102
7,638
Intel SGX total hack paper is in progress and I don't think Intel will like it ))
10
69
6
503
35,940
It turns out that Intel Gemini Lake Refresh platforms were supported by the new Intel SGX PCS (Provisioning Certification Service) remote attestation mechanism based on DCAP/ECDSA
1
2
1
28
2,586
This means we have compromised the actual Intel SGX 2.0, and anyone who hoped that only the older SGX was vulnerable was sorely mistaken... intel.com/content/www/us/en/…
3
12
1,021
Mark Ermolov retweeted
domas@xoreaxeaxeaxAug 13
New exploit: “xor dword [0xf80c2094], 1<<22” Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed. github.com/xoreaxeaxeax/skit…
167
1,072
184
8,173
1,099,491
Mark Ermolov retweeted
Alexander Popov@a13xp0p0vAug 2
⭐️My PoC exploit for CVE-2026-31695 in the Linux kernel is ready 🏁I managed to make it absolutely stable on Fedora 44 Server despite an elusive race condition during the exploitation 🛠This vuln existed for ≈5 years before I fixed it upstream ⚡️Gonna publish a detailed article!
4
19
1
180
11,266
Hacking into an Intel desktop platform...
8
5
156
8,272
Load more