研究人员Christopher Domas开发了名为skitter-creek-bath-salts的工具，通过修改DRAM控制器的地址转换来绕过CPU、固件和平台的内存保护机制[1]。该方法利用GF(2)线性代数求解未知的MCT/DCT转换矩阵，并使用z3 SMT求解器恢复记忆地址转换，实现对受保护内存区域的访问[1]。
在AMD Family 16h处理器上的验证中，该工具成功访问了平台安全处理器（PSP）DRAM保留区、系统管理模式（SMM）的SMI处理程序入口向量以及C6空闲状态下CPU核心的完整x86架构上下文，并提取了fTPM的crAmd_ModExp（RSA模幂运算例程）、SMI处理程序和微码补丁RAM拷贝等内容[1]。研究人员通过修改DRAM控制器的bank-swizzle-mode配置寄存器（xor dword [0xf80c2094]）实现了地址重映射[1]。
AMD Family 16h处理器数据表公开了DRAM控制器转换寄存器且无法被锁定，这使得上述攻击成为可能，而AMD 17h及更新代系未公开此类信息[1]。尽管该方法理论上适用于所有现代内存控制器架构（包括AMD、Intel、ARM和RISC-V等），但目前仅在AMD Family 16h上完整演示[1]。
Researcher Christopher Domas has developed a tool called skitter-creek-bath-salts that exploits DRAM controller address translation to circumvent memory protection mechanisms enforced by CPUs, firmware, and platforms [1]. By modifying the bank-swizzle-mode configuration register of the DRAM controller through address remapping, the technique gains unauthorized access to protected memory regions that should remain inaccessible [1].
The attack has been successfully demonstrated on AMD Family 16h processors, where it retrieves sensitive data including the Platform Security Processor (PSP) RSA engine, System Management Mode (SMM) handlers, and CPU microcode [1]. The researchers employed GF(2) linear algebra and the z3 SMT solver to recover the unknown memory controller transformation matrices, effectively reconstructing the address translation scheme [1]. Specifically, the tool can access the PSP DRAM reserved region at 0x7f800000 to extract the fTPM's RSA modular exponentiation routine, read SMI handler entry vectors at SMBASE + 0x8000, and retrieve the complete x86 architectural context stored during C6 idle states, including microcode patch RAM copies at +0x1800 offset [1].
While the technique is theoretically applicable to all modern memory controller architectures—including those from AMD, Intel, ARM, and RISC-V—a complete practical demonstration has only been achieved on AMD Family 16h to date [1]. This limitation exists because AMD Family 16h is the only generation for which DRAM controller translation registers are documented in publicly available datasheets; AMD's 17h and newer generations do not disclose this information [1].