Comments (15)
dgruss
commented on July 28, 2024
Some DRAM modules are not affected. Also the drama tool uses a side channel. The functions it prints are not necessarily
100% correct. It will require several hours of work to tweak the parameters to get stable and correct results. Then the
rowhammer tool might find bit flips with the correct functions.
We hammered one system with a 6700K and DDR4 memory for multiple weeks(!!) with the wrong functions without a single bit
flip. With the correct functions we had 1 bit flip every few seconds.
from drama.
KevinZhuYF
commented on July 28, 2024
So here is the function statics I have using your measure tool, I tested it with
taskset 0x4 sudo ./measure -p 0.7 -s 8
Result is here:
[DEBUG ] done measuring
reduced to 20 functions
6 (Correct: 100%)
7 14 (Correct: 100%)
15 18 (Correct: 75%)
16 19 (Correct: 100%)
17 20 (Correct: 100%)
11 12 13 15 27 (Correct: 50%)
8 9 11 16 27 (Correct: 50%)
9 22 23 26 29 (Correct: 50%)
12 17 24 28 30 (Correct: 100%)
7 10 15 29 30 (Correct: 50%)
7 9 11 13 32 (Correct: 75%)
9 17 21 23 32 (Correct: 100%)
17 28 29 31 33 (Correct: 100%)
11 13 21 24 34 (Correct: 75%)
8 11 29 30 34 (Correct: 100%)
13 22 24 25 27 29 (Correct: 75%)
10 16 22 23 24 31 (Correct: 100%)
And I set corresponding function using:
#define ARCH_SHIFT (2)
static const size_t h0[] = { 7, 14 };
static const size_t h1[] = { 15, 18 };
static const size_t h2[] = { 16, 19 };
static const size_t h3[] = { 17, 20 };
static const size_t h4[] = { 11, 12, 13, 15, 27 };
static const size_t h5[] = { 6};
#end
from drama.
KevinZhuYF
commented on July 28, 2024
I have run it for a few hours and I assume if the method is correct, I should get a flipping bit in a few second?
from drama.
dgruss
commented on July 28, 2024
On 15.02.2018 23:48, KevinZhuYF wrote:
static const size_t h4[] = { 11, 12, 13, 15, 27 };
I'm pretty sure that this one is wrong.
from drama.
KevinZhuYF
commented on July 28, 2024
Idealy I need to put functions with 100% correct?
from drama.
dgruss
commented on July 28, 2024
On 15.02.2018 23:49, KevinZhuYF wrote:
I have run it for a few hours and I assume if the method is correct, I should get a flipping bit in a few second?
Not if the DRAM module is unaffected. On DDR3 approximately 80% of the modules were affected. For DDR4 there is no
prevalence study, but probably it's a bit less than 80%, leading to a non-negligible chance that your modules are simply
unaffected.
from drama.
dgruss
commented on July 28, 2024
On 15.02.2018 23:50, KevinZhuYF wrote:
Idealy I need to put functions with 100% correct?
If the tool prints 100%, that just means that the side channel results for this one were not inconclusive. But it does
not mean that it is the correct function, the tool picks random addresses, and it just have picked the wrong addresses
which don't cover the cases where the results would be inconclusive.
from drama.
KevinZhuYF
commented on July 28, 2024
So that means I can't catch a single bit flipping at all? I have an old Mac Air, and I will try that machine as well. Your code could also run on Mac right?
from drama.
dgruss
commented on July 28, 2024
On 15.02.2018 23:53, KevinZhuYF wrote:
So that means I can't catch a single bit flipping at all?
If your modules are unaffected, sure, then you won't see a bit flip.
It is more likely though that the reverse-engineered functions are just not the correct ones.
I have an old Mac Air, and I will try that machine as well.
Your code could also run on Mac right?
No idea.
from drama.
KevinZhuYF
commented on July 28, 2024
So....basically I could only try different functions to see if I can discover the bit flipping?
from drama.
dgruss
commented on July 28, 2024
yes. but bit flipping can also take a while. we had one system with only like 3 bit flips in 8 hours.
from drama.
dgruss
commented on July 28, 2024
or you could try tweaking the drama_re parameters so that it provides you with the correct functions.. but that's also tricky
from drama.
KevinZhuYF
commented on July 28, 2024
cool...got it. Thanks. And is it normal that bit flipping usually takes a long time to be discovered?
from drama.
dgruss
commented on July 28, 2024
completely depends on the machine.
from drama.
KevinZhuYF
commented on July 28, 2024
Okay...thanks..and what is the most vulnerable setting according to your experience?
from drama.
Related Issues (4)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from drama.