39C3 - Opening pAMDora's box and unleashing a thousand paths on the journey to play Beatsaber custom

Introduction and Motivation00:00:16

The speaker introduces a collaborative project focused on hacking a commercial gaming console's hardware (specifically an AMD Zen 2 desktop board) to enable custom Beat Saber songs, despite initially facing significant security and firmware restrictions.

Platform Security Processor (PSP) and Boot Flow00:04:29

Explains the boot sequence of the AMD architecture, identifying the Platform Security Processor (PSP) and the off-chip bootloader as the primary roots of trust that must be compromised to gain full control.

Sniffing LPC and SPI Bus00:08:22

Describes using an LPC sniffer to observe post-codes during boot and replacing the unencrypted off-chip bootloader components with custom code to gain an initial foothold in the system.

Voltage Glitching and Mod-Chip Design00:30:46

Details the design of a custom mod-chip using an op-amp to manipulate the voltage regulator's feedback loop, allowing for precise undervolting and glitching to bypass security checks.

Results and Conclusion00:40:47

The speaker confirms that while their specific research was ongoing, public jailbreaks for the console were eventually released, enabling them to finalize the process of injecting custom Beat Saber maps.