- A
secret
byte you want to read is stored at inaccessible memory locationpriv_mem
. - The sender triggers an access exception by attempting to read
priv_mem
. - Due to CPU optimization (out-of-order execution), the load of
secret
frompriv_mem
and the use of its value in (4) and (5) below may execute before the exception is triggered. - Calculate an
offset
into a known arrayprobe
by multiplyingsecret
by the width of a cache line (or whatever block size the CPU typically fetches, like a 4096-byte page). This guarantees each of those 256 possible offsets will cache separately. - Load
probe[offset]
, which causes the CPU to cache exactly one chunk of of our array, populating one cache line. - The exception finally triggers, clearing the modified registers...but cached data is not excised.
- Iterate over all 256 offsets into
probe
to find out which one loads fast. You've determined the value ofsecret
.
THIS GIST WAS MOVED TO TERMSTANDARD/COLORS
REPOSITORY.
PLEASE ASK YOUR QUESTIONS OR ADD ANY SUGGESTIONS AS A REPOSITORY ISSUES OR PULL REQUESTS INSTEAD!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/sh | |
### | |
# SOME COMMANDS WILL NOT WORK ON macOS (Sierra or newer) | |
# For Sierra or newer, see https://github.com/mathiasbynens/dotfiles/blob/master/.macos | |
### | |
# Alot of these configs have been taken from the various places | |
# on the web, most from here | |
# https://github.com/mathiasbynens/dotfiles/blob/5b3c8418ed42d93af2e647dc9d122f25cc034871/.osx |