Overclock.net banner

Has using "Ryzen Timing Checker" caused any issues on your system?

  • Yes (please elaborate in a separate post)

    Votes: 6 6.4%
  • No

    Votes: 88 93.6%

Regarding the recent FUD about "Ryzen Timing Checker" (RTC)

33K views 137 replies 51 participants last post by  gupsterg 
#1 ·
During the past couple days a certain person (or persons) have been spreading blatant lies about the "Ryzen Timing Checker", claiming that it features malware and puts the systems it has been executed on in immediate risk.

Several additional claims regarding various aspects of it have been made by the same person, but listing all of them would be rather futile as some of the claims are outright insane (some of the claims about me e.g. working for "an outfit" can still be found from other topic on this forum).

So what Ryzen Timing Checker actually is and what exactly does it do?

RTC is a tiny application which can be used to read most of the DRAM timings on Zeppelin and Raven based CPUs and APUs. RTC accesses the DRAM timing (UMC) registers through the standard access port located in the PCI config space (SBDF). It uses a separate WinRing0 driver to access the hardware, because Windows (unlike Linux) doesn't provide a built-in access. Upon starting the RTC it executes several predefined PCI read and write operations (to the SMU data ports) and an additional MSR read operation (in order to check the platform compability). Once the program has finished reading the necessary registers, it displays the results and waits until the GUI window is terminated by the user. It doesn't perform any actions once the GUI is visible and never accesses the internet or the memory space.

How Ryzen Timing Checker was coded?

RTC uses AutoIT engine (version 3.3.14.2 to be specific). AutoIT is an automation language, and it's syntaxes are similar to BASIC. AutoIT is extremely versatile and based on my experience it is no lesser than the actual programming languages (C, C++, etc.) in terms of functionality, yet much more easier to produce code on.

AutoIT, like each and every other coding style / language has also been used for malicous purposes in the past. Because of that, some of the lesser AV solutions generally automatically flag all AutoIT executables as malware, regardless if there is anything malicious in them or not. Reputable AV providers such as F-Secure, Kaspersky or Symantec don't do that.

Read more about AutoIT: https://en.wikipedia.org/wiki/AutoIt
Check AutoIT's official website and user forum featuring > 72k members.

If there isn't anything malicious in the code, then why is the RTC binary distribution password protected and the binary itself encrypted?

The most convinient place for me (and the users downloading it) to host any file for the time being is OneDrive. There are several other potential places to host the files at, but none of the other free solutions are ad, popup and potentially malware (
wink.gif
) free. Based on my past experience OneDrive prevents downloading any archive, which contains an executable binary in it (regardless if it's e.g. the newest official Blender build). To prevent this behavior and to make it possible the users to download the app in the first place, the archive was password protected. That's simply a workaround for OneDrive's behavior, since it cannot block and archive containing an exe file if it cannot see it.

The RTC binary is not encrypted in any way. The RTC script is simply obfuscated in order to protect access methods and register information (i.e. which PCI device to access, which offsets and which SMU addresses), which as of now is still confidential. You can check if that's really the case by looking at the Zeppelin PPR available at AMD Techdocs: http://support.amd.com/TechDocs/54945_PPR_Family_17h_Models_00h-0Fh.pdf This document does not disclose (try seaching for a DRAM timing, e.g. tRFC) any of the information I just mentioned, and neither does any of the Github or Linux repos (as far as I know).

As said before, obfuscating the code makes it significantly harder to read (eventhou still possible) but it is by no means a method of encryption as it can still be read.

In order to end all of this crap that has been spread during the past couple days, I decided to release the non-obfuscated "source code" of the exact script used for RTC 1.01 version. The only changes which have been made to the code is related to confidential register info. In the sanitized version of the code the register addresses are set to zero. In order to compare the resulting code between the original release and the one you just compiled yourself, use following workflow:

How to audit the code?

- Download AutoIT: https://www.autoitscript.com/site/autoit/downloads/
- Install it
- Download the Obfuscator version used for RTC (AutoIt3 Source Obfuscator v1.0.30.4, by Jos van der Zande): https://1drv.ms/u/s!Ag6oE4SOsCmDhRTQg6bz8L_qyc8p (PW: Obfuscator)
- Save the script as Audit.au3
- Obfuscate the script source (.au3) using command "Obfuscator Audit.au3"
- Compile the resulting Audit_Obfuscated.au3 with AutoIT x64
- Download the original RTC 1.01 release: https://1drv.ms/u/s!Ag6oE4SOsCmDhQW33FeZaWSlOIds (PW: RyzenDRAM)
- Use 7-Zip to extract the compiled script from both of the exes (.rsrc\0\RCDATA\SCRIPT)
- Compare the sizes and other similarities

The size will differ by few bytes due to the sanitized register values, however you can verify that by changing them yourself as well.
Also try what happens if you make other kind of changes to the code.
Code:

Code:
#RequireAdmin
#NoTrayIcon
#include <EditConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
If Not FileExists("WinRing0x64.dll") Then
   MsgBox(16, "Error: A missing component", "Part of the driver: WinRing0x64.dll is missing!")
   Exit
ElseIf Not FileExists("WinRing0x64.sys") Then
   MsgBox(16, "Error: A missing component", "Part of the driver: WinRing0x64.sys is missing!")
   Exit
EndIf
If FileExists("Slow.txt") Then
   $SMUDelay = 60
Else
   $SMUDelay = 20
EndIf
$DLL = DllOpen("WinRing0x64.dll")
$InitCheck = DllCall($DLL, "bool", "InitializeOls")
Sleep(100)
$DllCheck = DllCall($DLL, "dword", "GetDllStatus")
Sleep(100)
If $InitCheck[0] = 0 Then
   MsgBox(16, "Cannot initialize the driver!", "The driver failed to initialize!")
   Exit
EndIf
If $DllCheck[0] = 1 Then
   MsgBox(16, "Driver error", "This platform is not supported by the driver!")
   Exit
ElseIf $DllCheck[0] = 2 Then
   MsgBox(16, "Driver error", "The driver could not be loaded!")
   Exit
ElseIf $DllCheck[0] = 3 Then
   MsgBox(16, "Driver error", "The driver seems to be incomplete. Please relocate the files!")
   Exit
ElseIf $DllCheck[0] = 4 Then
   MsgBox(16, "Driver error", "The driver has been unloaded unexpectedly!")
   Exit
ElseIf $DllCheck[0] = 9 Then
   MsgBox(16, "Driver error", "An unspecified error has occured!")
   Exit
EndIf
$CPUID = ""
$CPUFMS = ""
$SMUORG = ""
$BGS = ""
$DramConfiguration = ""
$DramTiming1 = ""
$DramTiming2 = ""
$DramTiming3 = ""
$DramTiming4 = ""
$DramTiming5 = ""
$DramTiming6 = ""
$DramTiming7 = ""
$DramTiming8 = ""
$DramTiming9 = ""
$DramTiming10 = ""
$DramTiming12 = ""
$DramTiming13 = ""
$DramTiming20 = ""
$DramTiming21 = ""
$DramTiming22 = ""
$tRFCTiming0 = ""
$tRFCTiming1 = ""
$tSTAGTiming0 = ""
$tSTAGTiming1 = ""
$DramTiming35 = ""
$tRFCTiming = ""
$tSTAGTiming = ""
$Preamble2T = ""
$GDM = ""
$Cmd2T = ""
$MEMCLK = ""
$MEMCLKTRxx = ""
$tRCDWR = ""
$tRCDRD = ""
$tRAS = ""
$tCL = ""
$tRPPB = ""
$tRP = ""
$tRCPB = ""
$tRC = ""
$tRTP = ""
$tRRDDLR = ""
$tRRDL = ""
$tRRDS = ""
$tFAWDLR = ""
$tFAWSLR = ""
$tFAW = ""
$tWTRL = ""
$tWTRS = ""
$tCWL = ""
$tWR = ""
$tRCPage = ""
$tRDRDBAN = ""
$tRDRDSCL = ""
$tRDRDSCDLR = ""
$tRDRDSC = ""
$tRDRDSD = ""
$tRDRDDD = ""
$tWRWRBAN = ""
$tWRWRSCL = ""
$tWRWRSCDLR = ""
$tWRWRSC = ""
$tWRWRSD = ""
$tWRWRDD = ""
$tWRRDSCDLR = ""
$tRDWR = ""
$tWRRD = ""
$tREF = ""
$tREFCT = ""
$tMODPDA = ""
$tMRDPDA = ""
$tMOD = ""
$tMRD = ""
$tSTAG = ""
$tCKE = ""
$tPHYWRD = ""
$tPHYRDLAT = ""
$tPHYWRLAT = ""
$tRDDATA = ""
$tRFC4 = ""
$tRFC4CT = ""
$tRFC2 = ""
$tRFC2CT = ""
$tRFC = ""
$tRFCCT = ""
$tSTAG4LR = ""
$tSTAG2LR = ""
$tSTAGLR = ""
$tWRMPR = ""
$CPUID = DllCall($DLL, "dword", "CpuidPx", "dword", "0x80000001", "dword*", "", "dword*", "", "dword*", "", "dword*", "", "uint", "0x01")
$CPUFMS = BitAND($CPUID[2], 0xFFFF00)
If Not ($CPUFMS = "0x00800F00" Or $CPUFMS = "0x00810F00") Then
   Msgbox(16, "Error", "The software only supports RV & ZP based Ryzen CPUs")
   DllCall($DLL, "none", "DeinitializeOls")
   Exit
EndIf
$SMUORG = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$BGS = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$BGSA = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramConfiguration = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming1 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming2 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming3 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming4 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming5 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming6 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming7 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming8 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming9 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming10 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming12 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming13 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming20 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming21 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming22 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$tRFCTiming0 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$tRFCTiming1 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$tSTAGTiming0 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$tSTAGTiming1 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "0x00000000")
Sleep($SMUDelay)
$DramTiming35 = DllCall($DLL, "dword", "ReadPciConfigDword", "byte", "0x00", "byte", "0x00", "dword", "")
Sleep($SMUDelay)

DllCall($DLL, "dword", "WritePciConfigDword", "byte", "0x00", "byte", "0x00", "dword", $SMUORG[0])
Sleep($SMUDelay)

If $tRFCTiming0[0] = $tRFCTiming1[0] Then ; Checks if 2DPC is used or if tRFC has been manually set.
   $tRFCTiming = $tRFCTiming0[0]
   $tSTAGTiming = $tSTAGTiming0[0]
ElseIf $tRFCTiming0[0] = 0x21060138 Then ; Checks if DIMM0 tRFC is set to AGESA defaults, meaning DIMM1 is populated.
   $tRFCTiming = $tRFCTiming1[0]
   $tSTAGTiming = $tSTAGTiming1[0]
Else
   $tRFCTiming = $tRFCTiming0[0]
   $tSTAGTiming = $tSTAGTiming0[0]
EndIf

If $BGS[0] = 2271560481 Then
   $BGS = "Disabled"
Else
   $BGS = "Enabled"
EndIf

If $BGSA[0] = 286328817 Then
   $BGSA = "Enabled"
Else
   $BGSA = "Disabled"
EndIf

$Preamble2T = BitAND($DramConfiguration[0], 0x1000)
$Preamble2T = BitShift($Preamble2T, 12)
If $Preamble2T = 1 Then
   $Preamble2T = "Enabled"
Else
   $Preamble2T = "Disabled"
EndIf

$GDM = BitAND($DramConfiguration[0], 0x800)
$GDM = BitShift($GDM, 11)
If $GDM = 1 Then
   $GDM = "Enabled"
Else
   $GDM = "Disabled"
EndIf

$Cmd2T = BitAND($DramConfiguration[0], 0x400)
$Cmd2T = BitShift($Cmd2T, 10)
If $Cmd2T = 1 Then
   $Cmd2T = "2T"
Else
   $Cmd2T = "1T"
EndIf

$MEMCLK = BitAND($DramConfiguration[0], 0x7F)
$MEMCLKTRxx = ($MEMCLK / 3) * 100
$MEMCLK = Int(($MEMCLK / 3) * 200)

$tRCDWR = BitAND($DramTiming1[0], 0x3F000000)
$tRCDWR = BitShift($tRCDWR, 24)

$tRCDRD = BitAND($DramTiming1[0], 0x3F0000)
$tRCDRD = BitShift($tRCDRD, 16)

$tRAS = BitAND($DramTiming1[0], 0x7F00)
$tRAS = BitShift($tRAS, 8)

$tCL = BitAND($DramTiming1[0], 0x3F)

$tRPPB = BitAND($DramTiming2[0], 0x3F000000)
$tRPPB = BitShift($tRPPB, 24)

$tRP = BitAND($DramTiming2[0], 0x3F0000)
$tRP = BitShift($tRP, 16)

$tRCPB = BitAND($DramTiming2[0], 0xFF00)
$tRCPB = BitShift($tRCPB, 8)

$tRC = BitAND($DramTiming2[0], 0xFF)

$tRTP = BitAND($DramTiming3[0], 0x1F000000)
$tRTP = BitShift($tRTP, 24)

$tRRDDLR = BitAND($DramTiming3[0], 0x1F0000)
$tRRDDLR = BitShift($tRRDDLR, 16)

$tRRDL = BitAND($DramTiming3[0], 0x1F00)
$tRRDL = BitShift($tRRDL, 8)

$tRRDS = BitAND($DramTiming3[0], 0x1F)

$tFAWDLR = BitAND($DramTiming4[0], 0x7E000000)
$tFAWDLR = BitShift($tFAWDLR, 25)

$tFAWSLR = BitAND($DramTiming4[0], 0xFC0000)
$tFAWSLR = BitShift($tFAWSLR, 18)

$tFAW = BitAND($DramTiming4[0], 0x7F)

$tWTRL = BitAND($DramTiming5[0], 0x7F0000)
$tWTRL = BitShift($tWTRL, 16)

$tWTRS = BitAND($DramTiming5[0], 0x1F00)
$tWTRS = BitShift($tWTRS, 8)

$tCWL = BitAND($DramTiming5[0], 0x3F)

$tWR = BitAND($DramTiming6[0], 0x7F)

$tRCPage = BitAND($DramTiming7[0], 0xFFF00000)
$tRCPage = BitShift($tRCPage, 20)

$tRDRDBAN = BitAND($DramTiming8[0], 0xC0000000)
$tRDRDBAN = BitShift($tRDRDBAN, 30)
If $tRDRDBAN = 0 Then
   $tRDRDBAN = "Disabled"
ElseIf $tRDRDBAN = 1 Then
   $tRDRDBAN = "Ban 2"
ElseIf $tRDRDBAN = 2 Then
   $tRDRDBAN = "Ban 2&3"
EndIf

$tRDRDSCL = BitAND($DramTiming8[0], 0xF000000)
$tRDRDSCL = BitShift($tRDRDSCL, 24)

$tRDRDSCDLR = BitAND($DramTiming8[0], 0xF00000)
$tRDRDSCDLR = BitShift($tRDRDSCDLR, 20)

$tRDRDSC = BitAND($DramTiming8[0], 0xF0000)
$tRDRDSC = BitShift($tRDRDSC, 16)

$tRDRDSD = BitAND($DramTiming8[0], 0xF00)
$tRDRDSD = BitShift($tRDRDSD, 8)

$tRDRDDD = BitAND($DramTiming8[0], 0xF)

$tWRWRBAN = BitAND($DramTiming9[0], 0xC0000000)
$tWRWRBAN = BitShift($tWRWRBAN, 30)
If $tWRWRBAN = 0 Then
   $tWRWRBAN = "Disabled"
ElseIf $tWRWRBAN = 1 Then
   $tWRWRBAN = "Ban 2"
ElseIf $tWRWRBAN = 2 Then
   $tWRWRBAN = "Ban 2&3"
EndIf

$tWRWRSCL = BitAND($DramTiming9[0], 0x3F000000)
$tWRWRSCL = BitShift($tWRWRSCL, 24)

$tWRWRSCDLR = BitAND($DramTiming9[0], 0xF00000)
$tWRWRSCDLR = BitShift($tWRWRSCDLR, 20)

$tWRWRSC = BitAND($DramTiming9[0], 0xF0000)
$tWRWRSC = BitShift($tWRWRSC, 16)

$tWRWRSD = BitAND($DramTiming9[0], 0xF00)
$tWRWRSD = BitShift($tWRWRSD, 8)

$tWRWRDD = BitAND($DramTiming9[0], 0xF)

$tWRRDSCDLR = BitAND($DramTiming10[0], 0x1F0000)
$tWRRDSCDLR = BitShift($tWRRDSCDLR, 16)

$tRDWR = BitAND($DramTiming10[0], 0x1F00)
$tRDWR = BitShift($tRDWR, 8)

$tWRRD = BitAND($DramTiming10[0], 0xF)

$tREF = BitAND($DramTiming12[0], 0xFFFF)
$tREFCT = Int(((1000 / $MEMCLKTRxx) * $tREF))

$tMODPDA = BitAND($DramTiming13[0], 0x3F000000)
$tMODPDA = BitShift($tMODPDA, 24)

$tMRDPDA = BitAND($DramTiming13[0], 0x3F0000)
$tMRDPDA = BitShift($tMRDPDA, 16)

$tMOD = BitAND($DramTiming13[0], 0x3F00)
$tMOD = BitShift($tMOD, 8)

$tMRD = BitAND($DramTiming13[0], 0x3F)

$tSTAG = BitAND($DramTiming20[0], 0xFF0000)
$tSTAG = BitShift($tSTAG, 16)

$tCKE = BitAND($DramTiming21[0], 0x1F000000)
$tCKE = BitShift($tCKE, 24)

$tPHYWRD = BitAND($DramTiming22[0], 0x7000000)
$tPHYWRD = BitShift($tPHYWRD, 24)

$tPHYRDLAT = BitAND($DramTiming22[0], 0x3F0000)
$tPHYRDLAT = BitShift($tPHYRDLAT, 16)

$tPHYWRLAT = BitAND($DramTiming22[0], 0x1F00)
$tPHYWRLAT = BitShift($tPHYWRLAT, 8)

$tRDDATA = BitAND($DramTiming22[0], 0x7F)

$tRFC4 = BitAND($tRFCTiming, 0xFFC00000)
$tRFC4 = BitShift($tRFC4, 22)

$tRFC4CT = Round(((1000 / $MEMCLKTRxx) * $tRFC4), 3)

$tRFC2 = BitAND($tRFCTiming, 0x3FF800)
$tRFC2 = BitShift($tRFC4, 11)
$tRFC2CT = Round(((1000 / $MEMCLKTRxx) * $tRFC2), 3)

$tRFC = BitAND($tRFCTiming, 0x7FF)
$tRFCCT = Round(((1000 / $MEMCLKTRxx) * $tRFC), 3)

$tSTAG4LR = BitAND($tSTAGTiming, 0x1FF00000)
$tSTAG4LR = BitShift($tSTAG4LR, 20)
If $tSTAG4LR = 0 Then
   $tSTAG4LR = "Disabled"
EndIf

$tSTAG2LR = BitAND($tSTAGTiming, 0x7FC00)
$tSTAG2LR = BitShift($tSTAG2LR, 10)
If $tSTAG2LR = 0 Then
   $tSTAG2LR = "Disabled"
EndIf

$tSTAGLR = BitAND($tSTAGTiming, 0x1FF)
If $tSTAGLR = 0 Then
   $tSTAGLR = "Disabled"
EndIf

$tWRMPR = BitAND($DramTiming35[0], 0x3F000000)
$tWRMPR = BitShift($tWRMPR, 24)
$RTC = GUICreate("Ryzen Timing Checker", 520, 600, 192, 124)
$MEMCLKBox = GUICtrlCreateInput($MEMCLK, 10, 14, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$MEMCLKLabel = GUICtrlCreateLabel("MEMCLK Ratio", 80, 17, 95, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($MEMCLKBox, $GUI_DISABLE)

$Cmd2tBox = GUICtrlCreateInput($GDM, 170, 14, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$Cmd2tLabel = GUICtrlCreateLabel("GearDownMode", 240, 17, 85, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($Cmd2tBox, $GUI_DISABLE)

$GDMBox = GUICtrlCreateInput($Cmd2t, 10, 44, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$GDMLabel = GUICtrlCreateLabel("Cmd2t", 80, 47, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($GDMBox, $GUI_DISABLE)

$BGSBox = GUICtrlCreateInput($BGS, 170, 44, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$BGSLabel = GUICtrlCreateLabel("BankGroupSwap", 240, 47, 85, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($BGSBox, $GUI_DISABLE)

$BGSABox = GUICtrlCreateInput($BGSA, 330, 14, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$BGSALabel = GUICtrlCreateLabel("BankGroupSwapAlt", 400, 17, 100, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($BGSABox, $GUI_DISABLE)

$tCLBox = GUICtrlCreateInput($tCL, 10, 94, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tCLLabel = GUICtrlCreateLabel("tCL", 80, 97, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tCLBox, $GUI_DISABLE)

$tRCDWRBox = GUICtrlCreateInput($tRCDWR, 10, 124, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRCDWRLabel = GUICtrlCreateLabel("tRCDWR", 80, 127, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRCDWRBox, $GUI_DISABLE)

$tRCDRDBox = GUICtrlCreateInput($tRCDRD, 10, 154, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRCDRDLabel = GUICtrlCreateLabel("tRCDRD", 80, 157, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRCDRDBox, $GUI_DISABLE)

$tRPBox = GUICtrlCreateInput($tRP, 10, 184, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRPLabel = GUICtrlCreateLabel("tRP", 80, 187, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRPBox, $GUI_DISABLE)

$tRASBox = GUICtrlCreateInput($tRAS, 10, 214, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRASLabel = GUICtrlCreateLabel("tRAS", 80, 217, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRASBox, $GUI_DISABLE)

$tRCBox = GUICtrlCreateInput($tRC, 10, 244, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRCLabel = GUICtrlCreateLabel("tRC", 80, 247, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRCBox, $GUI_DISABLE)

$tRRDSBox = GUICtrlCreateInput($tRRDS, 10, 274, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRRDSLabel = GUICtrlCreateLabel("tRRDS", 80, 277, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRRDSBox, $GUI_DISABLE)

$tRRDLBox = GUICtrlCreateInput($tRRDL, 10, 304, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRRDLLabel = GUICtrlCreateLabel("tRRDL", 80, 307, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRRDLBox, $GUI_DISABLE)

$tFAWBox = GUICtrlCreateInput($tFAW, 10, 334, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tFAWLabel = GUICtrlCreateLabel("tFAW", 80, 337, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tFAWBox, $GUI_DISABLE)

$tFAWDLRBox = GUICtrlCreateInput($tFAWDLR, 10, 364, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tFAWDLRLabel = GUICtrlCreateLabel("tFAWDLR", 80, 367, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tFAWDLRBox, $GUI_DISABLE)

$tFAWSLRBox = GUICtrlCreateInput($tFAWSLR, 10, 394, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tFAWSLRLabel = GUICtrlCreateLabel("tFAWSLR", 80, 397, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tFAWSLRBox, $GUI_DISABLE)

$tWTRSBox = GUICtrlCreateInput($tWTRS, 10, 424, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWTRSLabel = GUICtrlCreateLabel("tWTRS", 80, 427, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWTRSBox, $GUI_DISABLE)

$tWTRLBox = GUICtrlCreateInput($tWTRL, 10, 454, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWTRLLabel = GUICtrlCreateLabel("tWTRL", 80, 457, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWTRLBox, $GUI_DISABLE)

$tWRBox = GUICtrlCreateInput($tWR, 10, 484, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRLabel = GUICtrlCreateLabel("tWR", 80, 487, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRBox, $GUI_DISABLE)

$tRCPageBox = GUICtrlCreateInput($tRCPage, 10, 514, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRCPageLabel = GUICtrlCreateLabel("tRCPage", 80, 517, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRCPageBox, $GUI_DISABLE)

$tRDRDSCLBox = GUICtrlCreateInput($tRDRDSCL, 10, 544, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRDRDSCLLabel = GUICtrlCreateLabel("tRDRDSCL", 80, 547, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRDRDSCLBox, $GUI_DISABLE)

$tWRWRSCLBox = GUICtrlCreateInput($tWRWRSCL, 10, 574, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRWRSCLLabel = GUICtrlCreateLabel("tWRWRSCL", 80, 577, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRWRSCLBox, $GUI_DISABLE)

$tRFCBox = GUICtrlCreateInput($tRFC, 170, 94, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRFCLabel = GUICtrlCreateLabel("tRFC", 240, 97, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRFCBox, $GUI_DISABLE)

$tRFCCTBox = GUICtrlCreateInput($tRFCCT, 170, 124, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRFCCTLabel = GUICtrlCreateLabel("tRFC (ns)", 240, 127, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRFCCTBox, $GUI_DISABLE)

$tCWLBox = GUICtrlCreateInput($tCWL, 170, 154, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tCWLLabel = GUICtrlCreateLabel("tCWL", 240, 157, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tCWLBox, $GUI_DISABLE)

$tRTPBox = GUICtrlCreateInput($tRTP, 170, 184, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRTPLabel = GUICtrlCreateLabel("tRTP", 240, 187, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRTPBox, $GUI_DISABLE)

$tRDWRBox = GUICtrlCreateInput($tRDWR, 170, 214, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRDWRLabel = GUICtrlCreateLabel("tRDWR", 240, 217, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRDWRBox, $GUI_DISABLE)

$tWRRDBox = GUICtrlCreateInput($tWRRD, 170, 244, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRRDLabel = GUICtrlCreateLabel("tWRRD", 240, 247, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRRDBox, $GUI_DISABLE)

$tWRWRSCBox = GUICtrlCreateInput($tWRWRSC, 170, 274, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRWRSCLabel = GUICtrlCreateLabel("tWRWRSC", 240, 277, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRWRSCBox, $GUI_DISABLE)

$tWRWRSDBox = GUICtrlCreateInput($tWRWRSD, 170, 304, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRWRSDLabel = GUICtrlCreateLabel("tWRWRSD", 240, 307, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRWRSDBox, $GUI_DISABLE)

$tWRWRDDBox = GUICtrlCreateInput($tWRWRDD, 170, 334, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRWRDDLabel = GUICtrlCreateLabel("tWRWRDD", 240, 337, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRWRDDBox, $GUI_DISABLE)

$tRDRDSCBox = GUICtrlCreateInput($tRDRDSC, 170, 364, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRDRDSCLabel = GUICtrlCreateLabel("tRDRDSC", 240, 367, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRDRDSCBox, $GUI_DISABLE)

$tRDRDSDBox = GUICtrlCreateInput($tRDRDSD, 170, 394, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRDRDSDLabel = GUICtrlCreateLabel("tRDRDSD", 240, 397, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRDRDSDBox, $GUI_DISABLE)

$tRDRDDDBox = GUICtrlCreateInput($tRDRDDD, 170, 424, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRDRDDDLabel = GUICtrlCreateLabel("tRDRDDD", 240, 427, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRDRDDDBox, $GUI_DISABLE)

$tCKEBox = GUICtrlCreateInput($tCKE, 170, 454, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tCKELabel = GUICtrlCreateLabel("tCKE", 240, 457, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tCKEBox, $GUI_DISABLE)

$tRPPBBox = GUICtrlCreateInput($tRPPB, 170, 484, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRPPBLabel = GUICtrlCreateLabel("tRPPB", 240, 487, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRPPBBox, $GUI_DISABLE)

$tRCPBBox = GUICtrlCreateInput($tRCPB, 170, 514, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRCPBLabel = GUICtrlCreateLabel("tRCPB", 240, 517, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRCPBBox, $GUI_DISABLE)

$tRRDDLRBox = GUICtrlCreateInput($tRRDDLR, 170, 544, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRRDDLRLabel = GUICtrlCreateLabel("tRRDDLR", 240, 547, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRRDDLRBox, $GUI_DISABLE)

$tRDRDBANBox = GUICtrlCreateInput($tRDRDBAN, 170, 574, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRDRDBANLabel = GUICtrlCreateLabel("tRDRDBAN", 240, 577, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRDRDBANBox, $GUI_DISABLE)

$tRDRDSCDLRBox = GUICtrlCreateInput($tRDRDSCDLR, 330, 94, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRDRDSCDLRLabel = GUICtrlCreateLabel("tRDRDSCDLR", 400, 97, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRDRDSCDLRBox, $GUI_DISABLE)

$tWRWRBANBox = GUICtrlCreateInput($tWRWRBAN, 330, 124, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRWRBANLabel = GUICtrlCreateLabel("tWRWRBAN", 400, 127, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRWRBANBox, $GUI_DISABLE)

$tWRWRSCDLRBox = GUICtrlCreateInput($tWRWRSCDLR, 330, 154, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRWRSCDLRLabel = GUICtrlCreateLabel("tWRWRSCDLR", 400, 157, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRWRSCDLRBox, $GUI_DISABLE)

$tWRRDSCDLRBox = GUICtrlCreateInput($tWRRDSCDLR, 330, 184, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRRDSCDLRLabel = GUICtrlCreateLabel("tWRRDSCDLR", 400, 187, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRRDSCDLRBox, $GUI_DISABLE)

$tREFBox = GUICtrlCreateInput($tREF, 330, 214, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tREFLabel = GUICtrlCreateLabel("tREF", 400, 217, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tREFBox, $GUI_DISABLE)

$tREFCTBox = GUICtrlCreateInput($tREFCT, 330, 244, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tREFCTLabel = GUICtrlCreateLabel("tREF (ns)", 400, 247, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tREFCTBox, $GUI_DISABLE)

$tMODBox = GUICtrlCreateInput($tMOD, 330, 274, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tMODLabel = GUICtrlCreateLabel("tMOD", 400, 277, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tMODBox, $GUI_DISABLE)

$tMODPDABox = GUICtrlCreateInput($tMODPDA, 330, 304, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tMODPDALabel = GUICtrlCreateLabel("tMODPDA", 400, 307, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tMODPDABox, $GUI_DISABLE)

$tMRDBox = GUICtrlCreateInput($tMRD, 330, 334, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tMRDLabel = GUICtrlCreateLabel("tMRD", 400, 337, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tMRDBox, $GUI_DISABLE)

$tMRDPDABox = GUICtrlCreateInput($tMRDPDA, 330, 364, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tMRDPDALabel = GUICtrlCreateLabel("tMRDPDA", 400, 367, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tMRDPDABox, $GUI_DISABLE)

$tSTAGBox = GUICtrlCreateInput($tSTAG, 330, 394, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tSTAGLabel = GUICtrlCreateLabel("tSTAG", 400, 397, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tSTAGBox, $GUI_DISABLE)

$tPHYWRDBox = GUICtrlCreateInput($tPHYWRD, 330, 424, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tPHYWRDLabel = GUICtrlCreateLabel("tPHYWRD", 400, 427, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tPHYWRDBox, $GUI_DISABLE)

$tPHYWRLBox = GUICtrlCreateInput($tPHYWRLAT, 330, 454, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tPHYWRLLabel = GUICtrlCreateLabel("tPHYWRL", 400, 457, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tPHYWRLBox, $GUI_DISABLE)

$tPHYRDLBox = GUICtrlCreateInput($tPHYRDLAT, 330, 484, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tPHYRDLLabel = GUICtrlCreateLabel("tPHYRDL", 400, 487, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tPHYRDLBox, $GUI_DISABLE)

$tRDDATABox = GUICtrlCreateInput($tRDDATA, 330, 514, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tRDDATALabel = GUICtrlCreateLabel("tRDDATA", 400, 517, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tRDDATABox, $GUI_DISABLE)

$tSTAGLRBox = GUICtrlCreateInput($tSTAGLR, 330, 544, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tSTAGLRLabel = GUICtrlCreateLabel("tSTAGLR", 400, 547, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tSTAGLRBox, $GUI_DISABLE)

$tWRMPRBox = GUICtrlCreateInput($tWRMPR, 330, 574, 60, 18, BitOR($GUI_SS_DEFAULT_INPUT,$ES_CENTER))
GUICtrlSetFont(-1, 8, 400, 0, "Arial")
$tWRMPRLabel = GUICtrlCreateLabel("tWRMPR", 400, 577, 70, 17)
GUICtrlSetFont(-1, 8, 800, 0, "Arial")
GUICtrlSetState($tWRMPRBox, $GUI_DISABLE)
GUISetState(@SW_SHOW)

While 1
        $nMsg = GUIGetMsg()
        Switch $nMsg
        Case $GUI_EVENT_CLOSE
           DllCall($DLL, "none", "DeinitializeOls")
                        Exit

        EndSwitch
WEnd
 
See less See more
1
#52 ·
A sane and honorable person would have made sure his suspicions were in fact correct beyond reasonable doubt before going to anywhere near this level of allegation and defamation, and in doing so would already have the evidence requested.

From what I can see the problem is that there was no regard for throwing the stilt under the bus from the get go, rather than providing evidence when asked by all the sane people who have seen this go down.
 
#53 ·
Quote:
Originally Posted by VeritronX View Post

A sane and honorable person would have made sure his suspicions were in fact correct beyond reasonable doubt before going to anywhere near this level of allegation and defamation, and in doing so would already have the evidence requested.
Under the bus? The Stilt Timing Checker v1.01 or whatever it was before he released this new undetected version was detected by 2 dozen different antivirus firms and shortly was blacklisted by windows 10.
Those are facts. Are you saying you will vouch that all those antivirus engines, let alone any forum member, are detecting a false positive? To be clear, since you are defending somebody found already guilty on so many counts, you go and prove that he is wrongly convicted. And we will support both of you. I mean if Roger or "the Stilt" is 100% sure, we can start a petition here for Windows and Microsoft to whitelist his RTC 1.01. We can do. Hell, I will sign the petition myself. Until that happens however, him providing the AutoIt script does not wash him of what the app was.
smile.gif


I am not saying The Stilt is not helpful or not a nice guy, he is very helpful. However, I strongly suspect that his little app was a serious bit of malware. Don't agree with that? That is fine, you live your own life and make your own choices. This is only my opinion. I am not the police or the person who decides anything. Microsoft and other major firms strongly believe as well that what you are getting is a bad piece of malware. That is all.
 
#56 ·
Quote:
Originally Posted by keng View Post

Under the bus? The Stilt Timing Checker v1.01 or whatever it was before he released this new undetected version was detected by 2 dozen different antivirus firms and shortly was blacklisted by windows 10.
Those are facts. Are you saying you will vouch that all those antivirus engines, let alone any forum member, are detecting a false positive? To be clear, since you are defending somebody found already guilty on so many counts, you go and prove that he is wrongly convicted. And we will support both of you. I mean if Roger or "the Stilt" is 100% sure, we can start a petition here for Windows and Microsoft to whitelist his RTC 1.01. We can do. Hell, I will sign the petition myself. Until that happens however, him providing the AutoIt script does not wash him of what the app was.
smile.gif


I am not saying The Stilt is not helpful or not a nice guy, he is very helpful. However, I strongly suspect that his little app was a serious bit of malware. Don't agree with that? That is fine, you live your own life and make your own choices. This is only my opinion. I am not the police or the person who decides anything. Microsoft and other major firms strongly believe as well that what you are getting is a bad piece of malware. That is all.
The evidence I and others would want to see before trying to incriminate is proof of malicious intent.. In this case that the problem was not caused by the inclusion of the AutoIT tool. The reasons given so far by the stilt check out, and the one sticking point, the tool that caused all this mess, has been removed. The reasons given by you so far have not checked out vs his explanation nearly enough for the scale of your actions.

It's far from the first time I've run into the problem of AV solutions being lazy and assuming something is bad because their bot flagged it as a possibility when it's actually not, and none of them care to check if something like this actually designed to be malicious unless there is money involved. In the case of windows, rtc was used enough that it got blacklisted by their AV engine.. but I in no way think anyone took a single glance at it to determine what it actually does. It's an free program made by someone who doesn't pay them money for signing and likely never will, they don't care. And they certainly aren't enough to convict on to this extent.

So far you've proved that this warrants some investigation, and that you have way to much trust in the bots used by lazy AV solutions.

TL:DR we need proof that any of the things you are talking about are caused by the stilt and not by the inclusion of the AutoIT tool, and to know if any of your allegations hold true for the new version without that tool.
 
#57 ·
I installed Comodo antivirus.Windows defender says Use Comodo Antivirus instead of Windows defender and right now Comodo didn't react to RTC.
 
#58 ·
Quote:
Originally Posted by VeritronX View Post

The evidence I and others would want to see before trying to incriminate is proof of malicious intent.. In this case that the problem was not caused by the inclusion of the AutoIT tool. The reasons given so far by the stilt check out, and the one sticking point, the tool that caused all this mess, has been removed. The reasons given by you so far have not checked out vs his explanation nearly enough for the scale of your actions.

It's far from the first time I've run into the problem of AV solutions being lazy and assuming something is bad because their bot flagged it as a possibility when it's actually not, and none of them care to check if something like this actually designed to be malicious unless there is money involved. In the case of windows, rtc was used enough that it got blacklisted by their AV engine.. but I in no way think anyone took a single glance at it to determine what it actually does. It's an free program made by someone who doesn't pay them money for signing and likely never will, they don't care. And they certainly aren't enough to convict on to this extent.

So far you've proved that this warrants some investigation, and that you have way to much trust in the bots used by lazy AV solutions.

TL:DR we need proof that any of the things you are talking about are caused by the stilt and not by the inclusion of the AutoIT tool, and to know if any of your allegations hold true for the new version without that tool.
thumb.gif
 
#63 ·
#64 ·
Quote:
Originally Posted by keng View Post

Look, the 20 or 30 calls to the read/write pcibus are definitely there. The compiled autoit3 script name is RTC_BGSA.au3.tbl or similar
There is also A bunch of Binaryexecute(0xhe) which is ultimately where the hidden file is written and deleted.
thumb.gif
So you are saying the script source I posted in the OP doesn't do the same exact thing?
Meaning I altered the code in other ways, than just sanitizing the register values?

Please describe your workflow so that others can check as well.
 
#65 ·
Quote:
Originally Posted by The Stilt View Post

Quote:
Originally Posted by keng View Post

Look, the 20 or 30 calls to the read/write pcibus are definitely there. The compiled autoit3 script name is RTC_BGSA.au3.tbl or similar
There is also A bunch of Binaryexecute(0xhe) which is ultimately where the hidden file is written and deleted.
thumb.gif
So you are saying the script source I posted in the OP doesn't do the same exact thing?
Meaning I altered the code in other ways, than just sanitizing the register values?

Please describe your workflow so that others can check as well.
I would like to see his workflow as well, however in past threads he has been unable to to do this.
 
#67 ·
Quote:
Originally Posted by ENTERPRISE View Post

I would like to see his workflow as well, however in past threads he has been unable to to do this.
Based on what I'm seeing so far, my personal conclusion is leaning towards him being full of hot air.

He made some technical claims about the alleged suspicious behavior of RTC. But anyone who knows anything about assembly and machine language will see obvious issues with his explanation. So I pointed those out and asked for clarification and more details.

Instead of providing more details or any clarification, he insults me (deleted post) and tries to lecture me about the basics of buffer overflow attacks. At the same time, he completely disregards my questions about the protections that the OS and the hardware have specifically to prevent that kind of attack from working. What this tells me is that he's either really bad at communicating, or he doesn't really know what he's talking about and is just making things up.

Now he seems to have shifted his accusations to saying that RTC makes suspicious files and connects to the internet. While we haven't given it enough time yet, nobody has been able to reproduce it and he hasn't shown us how to reproduce it.

While none of this in any way exonerates The Stilt (and people have the right and should be suspicious), it does say a lot about the credibility of the accuser.
 
#70 ·
Quote:
Originally Posted by Mysticial View Post

Quote:
Originally Posted by ENTERPRISE View Post

I would like to see his workflow as well, however in past threads he has been unable to to do this.
Based on what I'm seeing so far, my personal conclusion is leaning towards him being full of hot air.

He made some technical claims about the alleged suspicious behavior of RTC. But anyone who knows anything about assembly and machine language will see obvious issues with his explanation. So I pointed those out and asked for clarification and more details.

Instead of providing more details or any clarification, he insults me (deleted post) and tries to lecture me about the basics of buffer overflow attacks. At the same time, he completely disregards my questions about the protections that the OS and the hardware have specifically to prevent that kind of attack from working. What this tells me is that he's either really bad at communicating, or he doesn't really know what he's talking about and is just making things up.

Now he seems to have shifted his accusations to saying that RTC makes suspicious files and connects to the internet. While we haven't given it enough time yet, nobody has been able to reproduce it and he hasn't shown us how to reproduce it.

While none of this in any way exonerates The Stilt (and people have the right and should be suspicious), it does say a lot about the credibility of the accuser.
He does indeed make some fairly grand claims. He has also done this in the Zenith Extreme thread stating he can get 4500 on Cinebench at stock (1950x) just by tweaking some BIOS settings. I asked for proof (Knowing it is not possible anyway) of course....he did not post any proof.

While I am not stating that the software created by Stilt is perfect, there is some serious lacking of proof or methodolgy from Keng. Lots of reposting content from the internet about threats...but nothing that relates to actual proof of his testing methodolgy. I have no choice but to call people out on that.
 
#72 ·
This might be duo the .NET library used by the RTC, dunno.
By just sampling the code you would indeed find private -> static -> hidebysig -> reuseslot on managed method along assembly reflector, anyway there are some kind of protection embedded so, either the dev explain with inlined code the critical under-the-hood stuff or if it a virus, at least it's not a procedural one..
/cheer!
 
#73 ·
Quote:
Originally Posted by xXlAinXx View Post

This might be duo the .NET library used by the RTC, dunno.
By just sampling the code you would indeed find private -> static -> hidebysig -> reuseslot on managed method along assembly reflector, anyway there are some kind of protection embedded so, either the dev explain with inlined code the critical under-the-hood stuff or if it a virus, at least it's not a procedural one..
/cheer!
The C# 1.02 version is "protected" with the open-source ConfuserEx.
 
#74 ·
Quote:
Originally Posted by keng View Post



wink.gif


You are free to get whatever software you want on your machine. Enjoy responsibly.

Stilt, if you want I can help you clear it up with someone from Microsoft/Symantec over Skype. Let me know
thumb.gif
I personally still do not beleive those numbers are at all accurate. A 1950x even Overclocked cannot reach those numbers. BIOS Tweaking is also not going to get you a 1000 Point increase over what is the average at 4.1Ghz which is 3500. I think you are an isolated case and the score is either a bug or there is some other factor at work here....but there is NO WAY that is a genuine performance score. Not unless everyother person on earth with a 1950X is doing it wrong. So I still call you out on that as I reckon you will still not share these ''Magical'' settings.

Anyone can show a picture, but backing it up in a reproducible way...I doubt you can.

Back on topic though, what was your testing procedure for Stilts software ?
 
#75 ·
Quote:
Originally Posted by Mysticial View Post

Based on what I'm seeing so far, my personal conclusion is leaning towards him being full of hot air.
Exactly. He's a noob that has found a few tools that disassemble or perform other analysis and he thinks he knows what he's looking at.

In another forum, this same guy claimed a conspiracy by UEFI BIOS builders because there was a whole bunch of free space left over in a 128Mb eprom when loaded with a 16MB bios image. He is apparently not able to perform the multiply by eight (x8) required to realize that 16MegaBytes is the same amount of space as 128MegaBits and therefore the image fits exactly.

He also doesn't seem to understand that AutoIT doesn't really compile a script to native code, rather it builds a block of pseudo code that it then executes at run-time. Because it does this, it doesn't really have the information a true compiler would use to optimize the library linkages because it doesn't know what might be called at run-time. So, lo and behold, it links in all of the potential calls that it can handle in case your script happens to call one at run-time. So he disassembles the executable and sees these network related calls in there and declares that this is a piece of malware.

This is wholly unwarranted. Anyone who develops software for a living should understand these concepts ... these being the people that could effectively use the tools that this noob is using to accuse The Stilt of malicious actions.

Yes, I'm sure people have tried to write malware using the AutoIT scripting language ... usually poorly educated wanna-be hackers which is why they were called "script kiddies". Yet there are far more people who have used AutoIT to perform useful tasks. Then you get these lazy AV people that just declare anything built on AutoIT to be malware. It's just a tool that can be used for nefarious purposes ... like a pencil. Most people write with a pencil but occasionally someone pokes an eye out with one. We don't ban pencils though. This guy making these claims is simply a naive pencil banner.

As a developer myself, I find this guy's claims abhorrent. I learned assembly on the 6502, 8080, and 8086, then moved on to C in college and C++. I don't program anymore unless I'm doing something on an 8051 at home for hobby related stuff. It's people like this guy that make me think that disassemblers and other development tools should require a license to use them. This guy is basically driving drunk with no license on internet forums accusing others of malfeasance.
 
#76 ·
Quote:
Originally Posted by ENTERPRISE View Post

I personally still do not beleive those numbers are at all accurate. A 1950x even Overclocked cannot reach those numbers. BIOS Tweaking is also not going to get you a 1000 Point increase over what is the average at 4.1Ghz which is 3500. I think you are an isolated case and the score is either a bug or there is some other factor at work here....but there is NO WAY that is a genuine performance score. Not unless everyother person on earth with a 1950X is doing it wrong. So I still call you out on that as I reckon you will still not share these ''Magical'' settings.

Anyone can show a picture, but backing it up in a reproducible way...I doubt you can.

Back on topic though, what was your testing procedure for Stilts software ?
He probably used the sleep bug and some tinfoil hat
biggrin.gif

https://community.amd.com/thread/221464
 
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top