Matt's Homepage

Primal Space (which has some fantastic videos with 3D model recreations) shows us the innovative Brennan gyroscopic monorail designed in the early 1900s.

Louis Brennan wondered if he could help the spread of rail by making it half as expensive – needing only one rail instead of two rails. But how do you balance tons of train on one rail?

In the end, he designed a monorail that defied conventional limitations by balancing on a single rail, leaning into corners without external input, and remaining stable (no hunting oscillation) even when stationary by the use of 2 extremely clever interconnected gyroscopes.

What seems to have largely done in the idea is that each car in the train would need its own gyroscope motor and assembly. It makes me wonder if there would be a way to reduce that space requirement using an interconnected air system in modern train brake systems to power the gyroscopes. But it also would have the unfortunate problem of falling over if the gyroscopes stopped/malfunctioned/ran out of fuel or weren’t parked with supports. It also didn’t remove the problem of needing to design and acquire right-of-way to lay the tracks in the first place.

Still – it’s quite amazing to see this thing in action. All done before computers and mechanically.

Rowhammer is a DRAM memory security vulnerability discovered in June 2014 (paper here). It demonstrates a security problem in which programs can modify memory they should not have access too. In the paper, they note how DRAM memory cells interact electrically between themselves by leaking their charges, possibly changing the contents of nearby memory rows that were not addressed in the original memory access. This circumvention of the isolation between DRAM memory cells results from the high cell density in modern DRAM, and can be triggered by specially crafted memory access patterns that rapidly activate the same memory rows numerous times.

The row hammer effect has been used in some privilege escalation computer security exploits (Paper here). Google’s Project Zero demonstrated two working privilege escalation exploits based on the row hammer effect in 2015. Since then, there has been a back and forth war of fixes and new exploits – some even involving ways to circumvent ECC (error-correcting) DRAM.

Now we fast forward to today, and there is another way to manipulate bits – RowPress (Paper here). Instead of ‘hammering’ neighbor rows with certain write patterns, this method involves manipulating the length of time the aggressor row is left open when reading it. When a computer accesses a chunk of memory, it opens the rows to the cells storing the desired data and transfers it to the CPU. The researchers show you can use clever methods to manipulate how long that row is left open. When an attacker row is left open the optimal amount, you can affect nearby victim rows:

We show that keeping a DRAM row (i.e., aggressor row) open for a long period of time (i.e., a large aggressor row on time, t_AggON) disturbs physically nearby DRAM rows. Doing so induces bitflips in the victim row without requiring (tens of) thousands of activations to the aggressor row. We characterize RowPress in 164 off-the-shelf DDR4 DRAM chips from all three major manufacturers and find that RowPress significantly amplifies DRAM’s vulnerability to read-disturb attacks (i.e., greatly reduces the minimum number of total aggressor row activations to cause at least one bitflip, AC_min.

The methods they use are VERY clever. They started on a FPGA-based test beds to test the idea, then moved to PC’s. This required a deep knowledge of memory hardware and involves clever manipulation of the memory controller and cache systems (section 6.2 of the paper). The summary in the comments was great:

With respect to knowing how physical memory maps to their process memory, they allocated a 1GB hugepage and use a technique called DRAMA to determine the row-column mapping.

To keep their target row open, they take advantage of the fact (new to me) that multiple cache blocks will live on the same physical row, which means that repeated accesses to those blocks can influence the memory controller to keep that row open. They also empty the processor cache between each iteration so that they can be sure that they will hit the actual RAM.
To bypass the target row refresh (TRR) mechanisms that have been implemented to counter traditional RowHammer attacks, they also toggle a large number of dummy rows so that the TRR will pick up on those rather than the actual aggressor rows, since TRR implementations apparently have a small number of candidate aggressor rows.

Article:

• https://arstechnica.com/security/2023/10/theres-a-new-way-to-flip-bits-in-dram-and-it-works-against-the-latest-defenses/

Engine exploits are great fun in games. They make the impossible possible and speedrunners love them. Payday and Payday 2 were written using the Diesel game engine and there have been a number of interesting bugs found over the years.

Here is a breakdown of 6 of the more exploitable bugs used by speedrunners.

Ronny Svedman gives a demonstration of a Tektronix 4006-1 a late 1970’s era tube vector graphics terminal. It’s now almost 50 years old, and should remind people that all the fancy graphics of today had their start a long, long time ago. This particular model has a Swedish EPROM (iso-10646-se) is rendered with slightly different characters.

This thing has some fantastic vector graphics that I wish we could still have today. Vector graphics is pretty limited, but it creates some really iconic images. Fun really starts at 3:54