A new technique called DRAM scrambling allows attackers to bypass platform protections on AMD CPUs by manipulating the memory controller's address translation registers. The method, demonstrated on AMD Family 16h processors, rewrites physical addresses at the lowest level of the memory hierarchy, making protected regions like PSP, SMM, and microcode accessible.

The exploit works by flipping a single bit in the DCT (DRAM Controller) swizzle mode, which scrambles how physical addresses map to actual DRAM coordinates. This causes the CPU and firmware to be unaware of the address remapping, effectively collapsing all protections built above the memory controller layer.

With careful timing and cache management, the technique can extract data from protected regions without crashing the system. The attack requires disabling application processors, priming TLBs, flushing caches, and quickly restoring mappings after data extraction.

The research highlights how legacy AMD CPUs expose memory controller registers that newer generations no longer document, suggesting similar vulnerabilities may exist across architectures including ARM and RISC-V.