Implement prefetch KASLR leak #152
Conversation
koczkatamas
left a comment
koczkatamas
left a comment
There was a problem hiding this comment.
Looks good! I had one question / change suggesion.
libxdk/util/pwn_utils.cpp
Outdated
| const uint64_t KASLR_SLOT_SIZE = 0x200000; | ||
|
|
||
| // The number of prefetch measurements per candidate address. | ||
| const int KASLR_NUM_MEASUREMENTS = 100; |
There was a problem hiding this comment.
How fast is the current leak algorithm (in seconds or milliseconds)?
If it is considerable amount (>500ms), then we should consider making this configurable (e.g. as an optional parameter for leak_kaslr_base) because in case of kernelCTF sometimes there is a race, and the seconds (milliseconds) matter who wins, so maybe researchers want to lower this value in some cases.
It is also possible that we want to increase this value in case of more noisy systems, I don't know how much noise affects prefetch leaks.
There was a problem hiding this comment.
Around 500k µs for 100 leaks on my laptop so around 5 ms per leak. I will make it configurable nonetheless.
2 participants
No description provided.