Reliable Reverse Engineering of Intel DRAM Addressing Using Performance Counters

Helm, Christian; Akiyama, Soramichi; Taura, Kenjiro

doi:10.1109/mascots50786.2020.9285962

Cited by 8 publications

(6 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On ARM, L1 instruction cache misses are strongly correlated (0.98) with L2 data accesses (L1_ICM vs. L2_DCA). In the absence of a dedicated L2 instruction cache [12], this indicates that the L2 data cache is used as a de facto instruction cache, echoing existing work on using HPCs to uncover latent SoC properties [9], [10].…”

Section: Hpc Correlation Analysismentioning

confidence: 94%

“…These utilised fresh TEE-bound keys which were generated at random on a per-session basis. 10 The aim, similar to §3, is to identify the precise algorithm used by the Victim from PMU measurements before and after its invocation by the Spy. The Spy is given only the aforementioned high-level functions for signing, verification, encryption, and decryption.…”

Section: Methodsmentioning

confidence: 99%

“…For reverse engineering, Maurice et al [9] use per-slice PMU access counter measurements to determine the cache slice assigned to a last-level cache (LLC) complex address for enabling cross-core LLC cache attacks. Helm et al [10] use HPCs for understanding Intel's proprietary DRAM mapping mechanism for translating physical addresses to physical memory channels, banks, and ranks. Similarly, the work uses differences in per-channel PMU transfer counters while accessing different known physical addresses.…”

Section: Related Workmentioning

confidence: 99%

“…Examples include accessing accurate timing sources for cache attacks, e.g. for cryptographic key recovery; intrusion detection [3], [4]; malware detection [5], [6], [7]; maintaining controlflow integrity [8]; and reverse engineering proprietary CPU features [9], [10]. While the security implications of highresolution HPCs have been acknowledged [11], [12], [13], they remain widely available on commercial platforms.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Investigating Black-Box Function Recognition Using Hardware Performance Counters

Shepherd¹,

Semal²,

Markantonakis³

2022

Preprint

View full text Add to dashboard Cite

This paper presents new methods and results for learning information about black-box program functions using hardware performance counters (HPC), where an investigator can only invoke and measure function calls. Important use cases include analysing compiled libraries, e.g. static and dynamic link libraries, and trusted execution environment (TEE) applications. We develop a generic machine learning-based approach to classify a comprehensive set of hardware events, e.g. branch mis-predictions and instruction retirements, to recognise standard benchmarking and cryptographic library functions. This includes various signing, verification and hash functions, and ciphers in numerous modes of operation. Three major architectures are evaluated using off-the-shelf Intel/X86-64, ARM, and RISC-V CPUs. Following this, we develop and evaluate two use cases. Firstly, we show that several known CVE-numbered OpenSSL vulnerabilities can be detected using HPC differences between patched and unpatched library versions. Secondly, we demonstrate that standardised cryptographic functions executing in ARM TrustZone TEE applications can be recognised using non-secure world HPC measurements. High accuracy was achieved in all cases (86.22-99.83%) depending on the application, architectural, and compilation assumptions. Lastly, we discuss mitigations, outstanding challenges, and directions for future research.

show abstract

Section: Hpc Correlation Analysismentioning

confidence: 94%

Section: Methodsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Investigating Black-Box Function Recognition Using Hardware Performance Counters

Shepherd¹,

Semal²,

Markantonakis³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Current computing systems employ various layers of address mappings that obfuscate the DRAM row-bank-column address mapping from the programmer [53]. Contemporary processors use complex functions to map physical addresses to DDRX addresses [54].…”

Section: Memory Allocation Mechanismmentioning

confidence: 99%

PiDRAM: A Holistic End-to-end FPGA-based Framework for Processing-in-DRAM

Olgun¹,

Gómez-Luna²,

Kanellopoulos³

et al. 2021

Preprint

View full text Add to dashboard Cite

Processing-using-memory (PuM) techniques leverage the analog operation of memory cells to perform computation. Several recent works have demonstrated PuM techniques (e.g., copy and initialization operations, bitwise operations, random number generation) in off-the-shelf DRAM devices. Since DRAM is the dominant memory technology as main memory in current computing systems, these PuM techniques represent an opportunity for alleviating the data movement bottleneck at very low cost. However, system integration of PuM techniques imposes non-trivial challenges (e.g., related to data allocation and alignment, memory coherence management) that are yet to be solved. Design space exploration of potential solutions to the PuM integration challenges requires appropriate tools to develop necessary hardware and software components. Unfortunately, current proprietary computing systems, specialized DRAM-testing platforms, or system simulators do not provide the flexibility and/or the holistic system view that is necessary to deal with PuM integration challenges.We design and develop PiDRAM, the first flexible endto-end framework that enables system integration studies and evaluation of real PuM techniques. PiDRAM provides software and hardware components to rapidly integrate PuM techniques across the whole system software and hardware stack (e.g., necessary modifications in the operating system, memory controller). We implement PiDRAM on an FPGAbased platform along with an open-source RISC-V system. To demonstrate the flexibility and ease of use of PiDRAM, we implement and evaluate two state-of-the-art PuM techniques. First, we implement in-memory copy and initialization. We propose solutions to integration challenges (e.g., memory coherence) and conduct a detailed end-to-end implementation study. Second, we implement a true random number generator in DRAM. Our results show that the in-memory copy and initialization techniques can improve the performance of bulk copy operations by 12.6× and bulk initialization operations by 14.6× on a real system. Implementing the true random number generator requires only 190 lines of Verilog and 74 lines of C code using PiDRAM's software and hardware components. PiDRAM is available on Github. 1

show abstract

A Rowhammer Reproduction Study Using the Blacksmith Fuzzer

Gerlach,

Thomas,

Pietsch

et al. 2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Rowhammer is a hardware vulnerability that can be exploited to induce bit flips in dynamic random access memory (DRAM), compromising the security of a computer system. Multiple ways of exploiting Rowhammer have been shown and even in the presence of mitigations such as target row refresh (TRR), DRAM modules remain partially vulnerable. In this paper, we present a large-scale reproduction study on the Rowhammer vulnerability using the Blacksmith Rowhammer fuzzer. The main focus of our study is the impact of the fuzzing environment. Our study uses a diverse set of 10 DRAM chips from various manufacturers, with different capacities and memory frequencies. We show that the runtime, used seeds, and DRAM coverage of the fuzzer have been underestimated in previous work. Additionally, we study the entire hardware setup's impact on the transferability of Rowhammer by fuzzing the same DRAM on 4 identical machines. The transferability study heavily relates to Rowhammer-based physically unclonable functions (PUFs) which rely on the stability of Rowhammer-induced bit flips. Our results confirm the findings of the Blacksmith fuzzer, showing that even modern DRAM chips are vulnerable to Rowhammer. In addition, we show that PUFs are challenging to achieve on commodity systems due to the high variability of Rowhammer bit flips.

show abstract

Reliable Reverse Engineering of Intel DRAM Addressing Using Performance Counters

Cited by 8 publications

References 10 publications

Investigating Black-Box Function Recognition Using Hardware Performance Counters

Investigating Black-Box Function Recognition Using Hardware Performance Counters

PiDRAM: A Holistic End-to-end FPGA-based Framework for Processing-in-DRAM

A Rowhammer Reproduction Study Using the Blacksmith Fuzzer

Contact Info

Product

Resources

About