How a Single Bit-Flip in DRAM Scrambling Unlocks the CPU

Flipping a single bit in a memory controller can bypass every hardware security boundary your CPU relies on.

Security researcher domas released skitter-creek-bath-salts, a tool showing how manipulating DRAM scrambling lets you override standard CPU restrictions. By changing translation registers inside the memory controller, the code rewires physical memory addresses into raw DRAM coordinates on the fly. Because hardware security checks sit higher up in the architecture, they never notice the underlying memory shift.

Why it matters: Security boundaries assume a physical address always points to the exact same physical memory location. Scrambling the DRAM coordinates beneath those checks breaks that guarantee, exposing hidden memory carveouts like System Management Mode (SMM), CPU microcode, and the Platform Security Processor (PSP).

Know this: The proof-of-concept target is AMD Family 16h processors, where the DRAM controller translation registers are documented and unlocked. Newer datasheets leave these register details out, but the hardware memory architecture and concepts apply across x86, ARM, and RISC-V chips.

Turns out physical memory addresses were just a polite suggestion all along.