I understand how it works but for example after reading 4 bytes, how do it undertand if it was originally an integer or 4 different characters? Both of them could give a meaningfull result.
closed as unclear what you're asking by Marcus Müller, Xiong Chiamiov, forest, Steffen Ullrich, Tobi Nary Mar 23 '18 at 12:38
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
The same as everything, really. Research and experimentation. For something like data in the Linux kernel the source is public and you can know what byte will be where (maybe it requires doing kernel debugging to be sure, but you can still get it). It's the same thing you had to do to figure out what "bad speculation" to cause to happen to get the desired data cached in the first place.
For Windows you'd do your research via the headers in the kernel SDK, or in books like "Windows Internals". It's, again, the same research you'd do to figure out what offsets you're looking for. Kernel debugging may help.
The only "spray and pray" approach would be looking for signallers. Some data structures start off with a 4-or-so byte identifier so that they can check the validity of provided data (in Windows these tend to be called
dwMagic). Having found a juicy one (again, from research you need to know what a juicy one is) you then know a relative offset (from research) of where the data you want is. But there's a lot of address space to search, so "spray and pray" is a bit unreliable.
Bytes are bytes. Whether something is read as an integer, character, image, audio, etc., is a property of a program, not the data. You can take a picture and then open it in a word processing program if you want. There are various forms of "metadata" that give information about what something is "supposed" to be interpreted as, such as file extensions. You can also look at whether it matches typical data of a particular type: you can check whether the data, interpreted as characters, forms a word in a known language, etc. But ultimately, if you take data, you have to decide what to do with it, and "Was this being interpreted as a character?" is just a small part of that. If you steal a password, for instance, you have to figure out what the password is for.