Project Logs

Collapse

• Copying Rows

  Tim • 4 days ago • 0 comments

  Now that we can set/erase entire rows, lets move on to another exploit: Copying rows. This approach has been outlined in RowClone: Fast and Energy-Efficient In-DRAM Bulk Data Copy and Initialization in 2013.

  We are using the access pattern that I called "RAS glitch high" for this, as shown in the scope image below.
  

  Copying rows works as follows:

  1. The source row is opened by pulling RAS low.
  2. The rows content is now loaded onto the bitlines and the read amplifiers will restore the charge from the array capacitors to full logic levels.
  3. We set the address of the target row on the address lines
  4. RAS is toggled to hi level for 40ns. This will activate the target row and connect it to the bitlines. Since the short RAS high time was not long enought to precharge the bitlines, they still contain the information from the source row. The low charge of the target row cells capacitors is not able to override this, so that the information from the source row is retained
  5. The read amplifiers will amplify the voltage levels on the bitline, which are dominated by the source row, and write the information to the target row

  Read more »

• Setting / Erasing entire rows at once

  Tim • 6 days ago • 0 comments

  So far I have only verified normal operation of the DRAM. Now lets move on the the hacking.

  The RAS signal controls the internal operations of the DRAM, many of which are limited in their speed by internal capacitances. Since the CH32V003, which I am using to control the DRAM, is clocked at 48MHz, it can actually toggle the control signals faster than the internal signals of the DRAM can follow.
  
  Let's first look at a situation where we pull the RAS signal low for only 40ns (two 48MHz clocks), shown as "RAS glitch low" in the scope image below.

  Read more »

• Reset Behavior

  Tim • 05/12/2025 at 20:20 • 0 comments

  Now we can read and write the DRAM. To inspect the basic behavior of the memory array, i displayed the first word of every of the 256 pages after turning on the power:

  All memory cells start with the same voltage on the capacitor (0V I presume, since the memory was powered off). However, half the memory cells are set to 0 and half to 1, depending on the row.
  
  The reason for this is that the read amplifiers are actually differential amplifiers. Half of the memory cells are connected to the inverting branch and half to the noninverting branch. The purpose of this is to balance bitline capacitance by ensuring that the same number of memory cells is connected to each bitline. When the a row is activated it will either change the voltage on the inverting or noninverting bitline and hence we either get a 0 or a 1 for 0V initial charge on the capacitor.

  Read more »

• Implementing DRAM access functions

  Tim • 05/10/2025 at 12:04 • 0 comments

  Reading and writing can be easily implemented by bitbanging.  To meet DRAM timing requirements we have to introduce delays by introducing various NOP cycles.

  // Compile-time delay macros for exact cycle counts without loop overhead
  #define DELAY_1_CYCLES() __asm volatile ("nop")
  #define DELAY_2_CYCLES() __asm volatile ("nop\nnop")
  #define DELAY_3_CYCLES() __asm volatile ("nop\nnop\nnop")
  #define DELAY_4_CYCLES() __asm volatile ("nop\nnop\nnop\nnop")
  #define DELAY_5_CYCLES() __asm volatile ("nop\nnop\nnop\nnop\nnop")
  
  // Specific delay macros for each timing parameter
  #define DELAY_RAS_CYCLES() DELAY_5_CYCLES() // ~100ns
  #define DELAY_CAS_CYCLES() DELAY_5_CYCLES() // ~100ns
  #define DELAY_RCD_CYCLES() DELAY_2_CYCLES()  // ~20ns
  #define DELAY_RP_CYCLES()  DELAY_5_CYCLES() // ~100ns

  The code below cycles first RAS and then CAS to read a bit from the array at the given address (designated as rows and columns).

  Read more »

• Accessing the Memory

  Tim • 05/05/2025 at 21:09 • 0 comments

  
  A classical DRAM only has few  control lines

  A0-A7        Multiplexed Address Lines
  Din, Dout    Datain/out. These lines can be shorted together for bidirectional I/O
  nWE          Write enable. When low, the selected memory cell is written to. 
  nRAS         Row Access Strobe - "Open" a row in the memory array
  nCAS         Column Access Strobe - selecto which bits in the row to access.

   A 64k*1 DRAM consists of a memory array of 256 columns and 256 rows.  Each memory cell is made up of a transistor and a capacitor.

  The core functionality of a DRAM is actually controlled by the RAS line. When it is pulled low ("Access"), the row indicated by the address pins is loaded from the memory arrray into the bitlines by activating the transistors in the memory cells. Since the charge on the capacitors is fairly small, the bitlines will only change their voltage slightly. However, at the same time the read amplifiers are activited, which will amplify the small voltage on the bitlines ("Sense") and pull the bitlines to up/down ("Restore").
  

  Read more »

• Experimental Set Up

  Tim • 05/05/2025 at 20:40 • 0 comments

  I will be experimenting with 4164 DRAMs chips which were used as main memory in many computers in the early 80ies. They are organized as 64k*1, so that eight chips are required for 64kbytes of RAM. Luckily I found a few from different vendors in my parts bin (I think I had more, but just kept one from each vendor.)

  The 4164 required a single 5V supply. Their access times are rather slow, 200ns to 300ns for the devices I have. The generation rationale behind this experiment is that modern microcontrollers are vastily faster than these devices and can be used to generate timing violations required for compute-in-memory instead of having to use a FPGA.

  I am going to use a CH32V003 microcontroller. These are rather low cost devices, but they come with 48MHz system clock and a RISC-V core (RV32EC), which as able to execute instructions 100-150x faster than a 1MHz 6502 from the 80ies. In addition, they offer 5V I/O which greatly simplifies interfacing to the 4164.
  

  Read more »

View all 6 project logs