skitter-creek-bath-salts

Modern CPUs wall off memory regions the operating system is never supposed to touch: AMD's PSP firmware, microcode, SMM. This project goes underneath all of that. By flipping configuration bits in the DRAM controller itself, it rewires how physical addresses map onto real memory, manufacturing aliases that point at protected regions without tripping the checks sitting above. MIT licensed, full source, and about as small as you would expect.

There is nothing to deploy. This is proof-of-concept research aimed at AMD Family 16h processors, the last generation whose datasheets publicly document the DRAM controller's translation registers. The argument is that the technique generalizes to Intel, ARM, and RISC-V, but the working code targets hardware from roughly a decade ago, and you need that hardware in front of you.

The audience is security researchers and people who design memory controllers. That is the entire list. It is not a defensive tool, there is nothing to configure, and it will not tell you whether your fleet is exposed.

The catch is that this is pre-publication. Two commits, a Black Hat 2026 talk still listed as coming soon, no paper, no written threat model, no vendor response. Read it as an argument about where memory protection breaks down, not as a result anyone has finished reviewing.