ManDeJan

This is very exciting to me

Kudos to the Sansec team for manually verifying the results and not flooding maintainers with AI generated bug reports

How does this work with interrupts, say in an embedded context, that execute on the current stack, and that may in some cases, be interrupted themselves. Do you add the maximum stack depth of all interrupt routines that could go off at the same time?

I read the firmware, it's build with the Arduino IDE and PWM for the heater element is bitbanged and updated from the main loop. Meaning it can easily get stuck sending a MQTT message over wifi when it loses connection, causing the heater to possibly be left on indefinitely.

A neat project for sure but as it stands this has major safety issues. The control logic is able to lock up and keep the boilers heating element in an forever "on" state till something snaps. I couldn't find a mention of safety in the manual nor see any mechanical safety failsafes in case of overheating.

The drive to create thinner, lighter, and more energy efficient devices has resulted in modern SoCs being forced to balance a delicate tradeoff between power consumption, heat dissipation, and execution speed (i.e., frequency). While beneficial, these DVFS mechanisms have also resulted in software-visible hybrid side-channels, which use software to probe analog properties of computing devices. Such hybrid attacks are an emerging threat that can bypass countermeasures for traditional microarchitectural side-channel attacks. Given the rise in popularity of both Arm SoCs and GPUs, in this paper we investigate the susceptibility of these devices to information leakage via power, temperature and frequency, as measured via internal sensors. We demonstrate that the sensor data observed correlates with both instructions executed and data processed, allowing us to mount software-visible hybrid side-channel attacks on these devices. To demonstrate the real-world impact of this issue, we present JavaScript-based pixel stealing and history sniffing attacks on Chrome and Safari, with all side channel countermeasures enabled. Finally, we also show website fingerprinting attacks, without any elevated privileges.

This is so sad

z...z.z...zz...lk.w...l..g..l.l..g...z...f..f.f..f..k.wg.r.a

May I ask, what language you were using back then?

amd64 instructions generally have longer encodings due to having to encode prefixes and 64-bit addresses.

Hi author here! Thanks for sharing my blog! It is currently still a draft, I'll repost it when it is finished :-)

I tried to do it as optimal as possible, but I think there is indeed more to be saved with putting code in the elf header, i'm not very familiar with the elf format. This is as small as I could get it without doing that, just using yasm, ld and strip.