Back 45 Years in the USSR
EVM
Where
Talks
ShmooCon 2024
Duration
44 min
Explores the undocumented Elbrus processor architecture and a C++ vtable overflow exploit ported to its compiler.
Summary
The talk looks at Elbrus, a 64-bit processor family with an architecture designed in Russia since the late 1970s and currently fabricated abroad. The speaker explains that the vendor publishes no datasheets or instruction encodings, so the research relied on a Russian programming guide, a Linux machine, the vendor's compiler and disassembler, and open-source binutils.
To test the chip, the speaker revisited a classic C++ virtual pointer overflow from a 2000-era hacking magazine and updated it for 64-bit addresses and modern GCC. The exploit needed changes for the new object layout, but after recompiling on the Elbrus machine it ran without further modification, since the vendor's compiler is a close port of GCC. The middle of the talk covers the very long instruction word format with its six ALU slots, register windowing with a separate procedure stack, and a two-stage call mechanism. The speaker patched binutils to print decoded instruction fields alongside the disassembly.
The takeaway is that an undocumented processor can be studied with open-source toolchains and a patched disassembler, and that older memory-safety bug classes still work on unfamiliar silicon. The speaker left exceptions and interrupt handling unexplored and notes that the platform's real-world use appears limited, so its future is uncertain.
Related talks
Talks·20 min
William
Shows how untrusted build code escapes SaaS trust boundaries through PATH, environment variables, git hooks, and LD_PRELOAD.
Main Stage·41 min
Darren McDonald
Shows how full disk encryption on Dell, HP and IGEL thin clients falls to boot chain and TPM flaws, letting an attacker reach the disk from a powered-off device.
Physical Security Village·36 min
Ben Higgins · Aaron Tulino
Shows how the Unsaflock hotel lock attack can run without any keycard, using a Flipper Zero to pull the property ID from the lock over the maintenance unit's NFC protocol.


