Skitter Creek Bath Salts Rewrites DRAM Security

This is a striking reminder that hardware abstractions only protect what their lowest layer enforces—and the project turns an undocumented-looking corner of the memory controller into a skeleton key.

• –A single DCT swizzle change can make physical addresses resolve to different DRAM locations beneath the CPU, chipset, and firmware protection layers
• –The toolkit reconstructs scrambled mappings with GF(2) linear algebra, then provides tools to dump or modify protected regions
• –Demonstrations reach PSP contents, SMM handlers, C6 register state, and cached CPU microcode on supported AMD hardware
• –The approach is platform-specific today, but the underlying interleave and remapping pipeline exists across modern AMD, Intel, ARM, and RISC-V systems
• –Developers should treat this as hardware-security research, not a turnkey universal exploit; it requires precise platform calibration, root access, and a narrow timing window