On: Undocumented x86 instructions to control the CPU a...

[tinktank]

How do people find these instructions?

[1-6 → tinktank]

Perhaps someone accidentally left the doors open on the Atom CPU which allowed them to run a disassembler.

"In mid-2020, our team managed to extract microcode for modern Atom processors that are based on the Goldmont microarchitecture. It became possible to do this on Atom Goldmont systems-on-chip (SoCs) due to an arbitrary code execution vulnerability in Intel CSME (Intel-SA-00086)."

[x0re4x → tinktank]

Probably using something like that: https://github.com/xoreaxeaxeax/sandsifter

[vsareto → x0re4x]

yeah, it's cited in the paper:

[4] C. Domas. Breaking the x86 ISA.https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Bre..., Jul. 2017.

[fart32 → x0re4x]

Reminded me his cool setup: https://youtu.be/_eSAF_qT_FY?t=1972

[sabas123 → tinktank]

They have been reverse engineering Atom for over half a decade (possibly longer) now.