-1

I understand how it works but for example after reading 4 bytes, how do it undertand if it was originally an integer or 4 different characters? Both of them could give a meaningfull result.

closed as unclear what you're asking by Marcus Müller, Xiong Chiamiov, forest, Steffen Ullrich, Tobi Nary Mar 23 '18 at 12:38

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • what does Meltdown have to do with that? and what does history of computing have to do with Information Security? – Marcus Müller Mar 15 '18 at 20:02
  • It's the most important part, if you cannot interpret what you read, the attack would be useless... – user173052 Mar 15 '18 at 20:10
  • ah, this makes more sense – Marcus Müller Mar 15 '18 at 20:12
  • 2
    You try to know what you're reading. Or you analyze until you know. How do you know whether what you're reading is a word from newspaper article or the telephone number in a paper phonebook? Either you look somewhere you know, or you start infering from the content and the context. – Marcus Müller Mar 15 '18 at 20:13
  • 1
    But it's the way to go. Either you know what you're looking at, or you guess and infer. What else do you expect me to say? I can reformulate this as information theoretical statement, but that would not change the message: You know what you know, and you can only infer with certainty the information of all information sources combined. One of these is the recovered bits. The others are context and knowledge of stochastical distributions, for example. – Marcus Müller Mar 15 '18 at 20:23
2

The same as everything, really. Research and experimentation. For something like data in the Linux kernel the source is public and you can know what byte will be where (maybe it requires doing kernel debugging to be sure, but you can still get it). It's the same thing you had to do to figure out what "bad speculation" to cause to happen to get the desired data cached in the first place.

For Windows you'd do your research via the headers in the kernel SDK, or in books like "Windows Internals". It's, again, the same research you'd do to figure out what offsets you're looking for. Kernel debugging may help.

The only "spray and pray" approach would be looking for signallers. Some data structures start off with a 4-or-so byte identifier so that they can check the validity of provided data (in Windows these tend to be called dwMagic). Having found a juicy one (again, from research you need to know what a juicy one is) you then know a relative offset (from research) of where the data you want is. But there's a lot of address space to search, so "spray and pray" is a bit unreliable.

1

Bytes are bytes. Whether something is read as an integer, character, image, audio, etc., is a property of a program, not the data. You can take a picture and then open it in a word processing program if you want. There are various forms of "metadata" that give information about what something is "supposed" to be interpreted as, such as file extensions. You can also look at whether it matches typical data of a particular type: you can check whether the data, interpreted as characters, forms a word in a known language, etc. But ultimately, if you take data, you have to decide what to do with it, and "Was this being interpreted as a character?" is just a small part of that. If you steal a password, for instance, you have to figure out what the password is for.

Not the answer you're looking for? Browse other questions tagged or ask your own question.