Scholarlink

In this paper, we introduce a novel approach to reliably verifying DRAM addressing functions and function components from software. We perform the first systematic analysis of 5 DRAM function reverse-engineering tools on 2 different DDR3, 4 DDR4, and 4 DDR5 system configurations, revealing a significant variance in the success rate of these tools, from 0% to 92.9%. We discover the previously unknown rank selection side channel and reverse engineer its function on two DDR4 and two DDR5 systems. These results enable novel DDR5 row-conflict side-channel attacks, which we demonstrate in two scenarios: First, we evaluate the DDR5 row-conflict side channel in a covert channel with 1.39Mbit/s. Second, we evaluate the channel in a website fingerprinting attack with an F \(_1\) score of 84% on DDR4 and 74% on DDR5.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Verifying DRAM Addressing in Software

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Martin Heckel,
  • Florian Adamsky,
  • Jonas Juffinger,
  • Fabian Rauscher,
  • Daniel Gruss

摘要

In this paper, we introduce a novel approach to reliably verifying DRAM addressing functions and function components from software. We perform the first systematic analysis of 5 DRAM function reverse-engineering tools on 2 different DDR3, 4 DDR4, and 4 DDR5 system configurations, revealing a significant variance in the success rate of these tools, from 0% to 92.9%. We discover the previously unknown rank selection side channel and reverse engineer its function on two DDR4 and two DDR5 systems. These results enable novel DDR5 row-conflict side-channel attacks, which we demonstrate in two scenarios: First, we evaluate the DDR5 row-conflict side channel in a covert channel with 1.39Mbit/s. Second, we evaluate the channel in a website fingerprinting attack with an F \(_1\) score of 84% on DDR4 and 74% on DDR5.