Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Back 45 Years in the USSR

EVM

HardwareTalks44 minAdvancedOpen on YouTube ↗

Where

Talks
ShmooCon 2024

Duration

44 min

Explores the undocumented Elbrus processor architecture and a C++ vtable overflow exploit ported to its compiler.

Summary

The talk looks at Elbrus, a 64-bit processor family with an architecture designed in Russia since the late 1970s and currently fabricated abroad. The speaker explains that the vendor publishes no datasheets or instruction encodings, so the research relied on a Russian programming guide, a Linux machine, the vendor's compiler and disassembler, and open-source binutils.

To test the chip, the speaker revisited a classic C++ virtual pointer overflow from a 2000-era hacking magazine and updated it for 64-bit addresses and modern GCC. The exploit needed changes for the new object layout, but after recompiling on the Elbrus machine it ran without further modification, since the vendor's compiler is a close port of GCC. The middle of the talk covers the very long instruction word format with its six ALU slots, register windowing with a separate procedure stack, and a two-stage call mechanism. The speaker patched binutils to print decoded instruction fields alongside the disassembly.

The takeaway is that an undocumented processor can be studied with open-source toolchains and a patched disassembler, and that older memory-safety bug classes still work on unfamiliar silicon. The speaker left exceptions and interrupt handling unexplored and notes that the platform's real-world use appears limited, so its future is uncertain.

Related talks