xoreaxeaxeax/skitter-creek-bath-salts

This project demonstrates a technique for breaking into protected areas of computer memory by manipulating the lowest layer of how memory addresses work. The core idea is that when software reads or writes memory, the address it uses passes through many translation steps before reaching the actual physical memory chips. This project targets the very last step in that chain, the memory controller, which converts addresses into raw coordinates for the DRAM chips. The exploit itself is surprisingly small. By flipping a single bit in a memory controller register, the project rewires how physical addresses map to actual memory locations. This means data that should land in a protected, hidden region of memory can be redirected elsewhere. Because every security mechanism built into the CPU, firmware, and operating system operates above the memory controller, none of them detect that the mapping has been altered. The security barriers guard physical addresses, but the scrambling happens below that level. The project targets AMD Family 16h CPUs specifically, which is the last generation whose public datasheets documented the memory controller's translation registers and confirmed they cannot be locked. Later generations simply omitted this documentation. The author notes that the underlying address transformation concepts extend to other architectures including ARM and RISC-V, but this code only demonstrates the starting point. The README includes a detailed diagram of the full address translation pipeline, from the virtual address a program uses down through page tables, TLB lookups, IOMMU walks, cache coherence protocols, and finally the memory controller's remapping and scramble stages. The project works at that final layer, where addresses are rewritten into the bank, row, and column coordinates sent to the memory chips. The full README is longer than what was shown.