Unlocking everything on the CPU with DRAM scrambling — PSP, C6, microcode, SMM, and anything else the specs left out. &x == &x. Usually. Poke the DRAM controller and an address can be made to land wherever you want in memory. skitter-creek-bath-salts reaches into the deepest level of the memory hierarchy and rewires the physical DRAM address translations, to scramble platform memory and release its most guarded secrets — the specialized carveouts invisible even to the kernel. When the translatio...