Reverse Engineering of Intel Microcode Update Structure

Abstract

Microcode update mechanism have been widely used in modern processors. Due to the implementation details are not public, researchers are prevented from gaining any sort of further understanding currently. The microcode update binary which uploaded into Central Processing Unit (CPU) is the only accessible node in this update chain by researchers, but previous manual reverse analysis for a small amount of microcode updates has the disadvantages of incomplete coverage, slow speed, and low accuracy. Therefore, we first build a Sample Repository containing 504 Intel official microcode updates, then propose a semiautomatic analytical method named SJNW-MA to analyze samples. This work has the following merits: (1) automatic methods of similarity analysis and candidate feature mining improve the speed; (2) manual-assisted analysis based on expert knowledge can filter important features, to avoid redundant features or valuable common data blocks missing; (3) analysis for 504 microcode updates make the results of reverse engineering are more complete. Finally, we extract eleven structures of Intel microcode updates and group them into four categories. In addition, we also identify and describe some new metadata in microcode updates of the third and the fourth category, including a new 3072-bit RSA Modulus as well as corresponding RSA Exponent which indicates upgrade of security technology inside update mechanism. INDEX TERMS microcode update, reverse engineering, Central Processing Unit ZH. Yang et al.: Reverse Engineering of Intel Microcode Update Structure ZHIGUO YANG is currently pursuing the master's degree with the State Key Laboratory of Mathematical Engineering and Advanced Computing, China. His research interesting include reverse engineering and vulnerability of hardware, trusted computing. QINGBAO LI is currently a Professor with the State Key Laboratory of Mathematical Engineering and Advanced Computing, China. His researches focus on trusted computing and security of hardware. PING ZHANG is currently a Professor with the State Key Laboratory of Mathematical Engineering and Advanced Computing, China. Her researches focus on binary analysis and disassembly. ZHIFENG CHEN is currently a Lecturer with the State Key Laboratory of Mathematical Engineering and Advanced Computing, China. His research interests include network and information security.