I understand how it works but for example after reading 4 bytes, how do it undertand if it was originally an integer or 4 different characters? Both of them could give a meaningfull result.
6
-
what does Meltdown have to do with that? and what does history of computing have to do with Information Security?– Marcus MüllerMar 15, 2018 at 20:02
-
It's the most important part, if you cannot interpret what you read, the attack would be useless...– user173052Mar 15, 2018 at 20:10
-
ah, this makes more sense– Marcus MüllerMar 15, 2018 at 20:12
-
2You try to know what you're reading. Or you analyze until you know. How do you know whether what you're reading is a word from newspaper article or the telephone number in a paper phonebook? Either you look somewhere you know, or you start infering from the content and the context.– Marcus MüllerMar 15, 2018 at 20:13
-
1But it's the way to go. Either you know what you're looking at, or you guess and infer. What else do you expect me to say? I can reformulate this as information theoretical statement, but that would not change the message: You know what you know, and you can only infer with certainty the information of all information sources combined. One of these is the recovered bits. The others are context and knowledge of stochastical distributions, for example.– Marcus MüllerMar 15, 2018 at 20:23
|
Show 1 more comment
2 Answers
The same as everything, really. Research and experimentation. For something like data in the Linux kernel the source is public and you can know what byte will be where (maybe it requires doing kernel debugging to be sure, but you can still get it). It's the same thing you had to do to figure out what "bad speculation" to cause to happen to get the desired data cached in the first place.
For Windows you'd do your research via the headers in the kernel SDK, or in books like "Windows Internals". It's, again, the same research you'd do to figure out what offsets you're looking for. Kernel debugging may help.
The only "spray and pray" approach would be looking for signallers. Some data structures start off with a 4-or-so byte identifier so that they can check the validity of provided data (in Windows these tend to be called dwMagic). Having found a juicy one (again, from research you need to know what a juicy one is) you then know a relative offset (from research) of where the data you want is. But there's a lot of address space to search, so "spray and pray" is a bit unreliable.
Bytes are bytes. Whether something is read as an integer, character, image, audio, etc., is a property of a program, not the data. You can take a picture and then open it in a word processing program if you want. There are various forms of "metadata" that give information about what something is "supposed" to be interpreted as, such as file extensions. You can also look at whether it matches typical data of a particular type: you can check whether the data, interpreted as characters, forms a word in a known language, etc. But ultimately, if you take data, you have to decide what to do with it, and "Was this being interpreted as a character?" is just a small part of that. If you steal a password, for instance, you have to figure out what the password is for.
