READ THE SOURCES / UNDERSTAND THE INFLUENCE
Beyond the host.
James’s path from mobile isolation and packet processing toward independent security observation. These local notes distinguish his experiments from the published research that informed them.
Start with James’s dated NVIDIA comment, or follow the research chronologically below.
THE NEXT CONNECTION / IVRE & FORENSICS
From research influence to network-data investigation
James connects Atamli’s approach with his continuing work on IVRE, Nmap, rapid data collection and forensic visualisation: searching for exposed information and replaying network relationships over time. Twelve supplied recordings now document this wider body of work, with local playback and original source references.
2019 / THE SUPPLIED PAPER
IO-Trust: where the trust boundary sits
Ahmad Atamli, Giuseppe Petracca and Jon Crowcroft · ARES 2019. James supplied 3339252.3340511.pdf, a seven-page copy. The paper studies reliable out-of-band acquisition of host physical memory when IOMMU translation data in host RAM may be controlled by compromised software.
Sections 3 and 4 set out the trust model and investigate pass-through and PCIe Address Translation Services. Evaluation uses an Intel Arria 10 GX/GT FPGA board. It does not describe an immutable memory partition created by a hypervisor as the central solution.
Its assumptions matter: the platform starts in a trusted state, peripheral firmware is attested, the attacker cannot alter that firmware, and physical attacks are excluded. Section 5.2 limits observation to system RAM and explains why accessing peripheral address space can be unsafe. This is not evidence of universal UEFI extraction or complete device-firmware capture.
Document identity and version note
The supplied copy’s title and authors match the IO-Trust bibliographic record. Its front matter contains a different, placeholder-like DOI (10.1145/1122445.1122456) and ISBN. The catalogue DOI is 10.1145/3339252.3340511. The final publisher version was unavailable to this review, so the local copy is described as supplied rather than certified as the version of record.
SHA-256: c16b11eac3104df794cc052271043396cf44fd3766794a2e1d5d51a0899cd4f8
2021 / ATAMLI’S ARTICLE
A separate processor, an independent view
In his NVIDIA article of 14 January 2021, Dr. Ahmad Atamli describes a BlueField experiment that extends Volatility for live-memory analysis. Code runs on the device’s Arm cores and requests selected host-memory segments through a memory-access SDK.
The distinction is architectural: BlueField combines a ConnectX controller with Arm processing. A standalone ConnectX-5 adapter is not interchangeable with that complete DPU. The article supports live memory forensics; it does not establish that every motherboard’s firmware can be extracted remotely.
Read Atamli’s original NVIDIA article ↗ · Original BlueField architecture reference ↗
17 NOVEMBER 2021 / THE PUBLIC RECORD
James joins the discussion
Account: jamestervit · reply 2.
“We are experimenting with OOB and wireline fingerprinting.”
His reply also mentions the Morpheus programme and an interest in exploring BlueField V3. This provides a dated public connection between James’s network-security experiments and Atamli’s article.
A local excerpt and summary are preserved here. The public forum result exposed the reply; direct retrieval of the individual reply was unavailable. The comment records experimentation and intent, without establishing a completed deployment or a collaboration with the paper’s authors.
Original comment ↗ · Full original discussion ↗ · Local forum record →
2022 / LINUX TRACING
Memory samples reconstructed into a trace
Thanh Nguyen, Meni Orenbach and Ahmad Atamli published Live system call trace reconstruction on Linux at DFRWS USA 2022. Their non-intrusive prototype uses LibVMI with a KVM/QEMU memory-sampling framework to recover syscall information from saved process context.
This is a distinct implementation from the earlier BlueField/Volatility demonstration. The paper’s evaluation supports its tracing method under the tested conditions; it is not a demonstration that a network card continuously intercepts every syscall on arbitrary Windows and Linux machines.
2023 / INDUSTRIAL RESEARCH
From introspection to AppShield
The ESORICS 2023 industrial programme identifies Dr. Atamli as a security architect of BlueField and describes DOCA AppShield’s use of an isolated DPU for virtual-machine introspection. This supports the research connection James followed.
NVIDIA’s App Shield guide documents a configured platform with compatible software, memory profiles and prerequisites. Hardware isolation has a defined trust boundary; it does not make a monitor universally invisible, immutable or impossible to stop.
ESORICS speaker and talk record ↗ · NVIDIA App Shield documentation ↗
2026 / A SEPARATE FIRMWARE REFERENCE
Parsing firmware is a different task
The supplied Carnegie Mellon SEI article describes the CERT UEFI Parser, a tool for examining firmware-image structures. It is useful context for firmware analysis, but it does not attribute a remote DPU firmware-acquisition method to Atamli. The supplied references also do not establish GNN or control-flow attestation as a universal firmware-signature check inside the network card.
The networking and visualisation foundation
James places his ConnectX-5 tuning before NVIDIA completed its Mellanox acquisition on 27 April 2020. VPP and DPDK describe packet-processing technologies; Matplotlib is a Python visualisation library. Their role in James’s work is recorded in his résumé, without presenting those tools alone as an AI model.
Source review: 27 September 2026. Local summaries and original reference links are read-only. Research credit remains with the named authors.