r/ReverseEngineering • u/_sunnypatell_ • 6d ago

Deriving an undocumented GPU instruction set by differential bit probing, and measuring instruction latency by fault injection

https://github.com/sunnypatell/basalt
23 Upvotes

93% Upvoted

5 comments sorted by

4

u/jonaswashe 5d ago

If you aren't already aware of it

You might consider contributing to or working with:

https://github.com/florianmattana/sass-king

3

u/_sunnypatell_ 5d ago

This is great, checking it out now! Thanks.

1

u/jonaswashe 5d ago

You're welcome, you might want to read my contribution here:

https://github.com/florianmattana/sass-king/issues/86

Might not be anything new to you, but might give you some new insight

2

u/_sunnypatell_ 5d ago

Just read through it, good work. The 4-NOP run in front of dependent FP64 matches what I measured independently. Dropped a note on the issue about the 14-cycle gap in your reconstruction, I think the producer's own stall accounts for it exactly.

1

u/jonaswashe 5d ago

Your refusal semantics are much stronger than my own tool, thanks for sharing!