Bootstrapping an Architectural Research Platform

Explore the fundamentals of x86 architectural research for security professionals in this 56-minute conference talk from 44CON Information Security Conference. Gain essential knowledge on CPU ring privileges, architectural events monitoring, and research hypervisors. Learn about protected mode, paging, cache, virtualization, boot processes, memory management, and advanced concepts like performance counters and branch tracing. Discover tools such as LibPMI, Simplevisor, and PuffWrap for rapid research setup, and understand case studies on OS monitoring and troubleshooting. Equip yourself with the skills to focus on critical research questions while minimizing setup time in x86 platform security investigations.

Introduction
Why this talk
Agenda
Protected Mode
Paging
Cache
Virtualization
Boot Process
Memory Management
General Protection Fault
Performance Counters
Branch Tracing
VMExit
EPT
SMM
SMI
Questions
Case Study
Monitoring OS
Troubleshooting
Bare flank
First open source
Subclasses
LibPMI
Simplevisor
Skeleton Kernel
UEFI
Puff
Wrap Up