Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Results #1

Open
crozone opened this issue Jan 5, 2018 · 47 comments
Open

Results #1

crozone opened this issue Jan 5, 2018 · 47 comments

Comments

@crozone
Copy link
Owner

crozone commented Jan 5, 2018

OS

Linux 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3+deb9u1 (2017-12-23) x86_64 GNU/Linux

CPU:

vendor_id       : AuthenticAMD
cpu family      : 22
model           : 48
model name      : AMD GX-412TC SOC
stepping        : 1
microcode       : 0x7030105
cpu MHz         : 600.000
cache size      : 2048 KB

Results (CACHE_HIT_THRESHOLD = 300):

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfed78... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfed79... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfed7a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfed7b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed7c... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfed7d... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfed7e... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfed7f... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfed80... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfed81... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed82... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfed83... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfed84... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfed85... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfed86... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed87... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed88... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfed89... Unclear: 0x72=’r’ score=998 (second best: 0xB7 score=974)
Reading at malicious_x = 0xffffffffffdfed8a... Unclear: 0x65=’e’ score=999 (second best: 0x4D score=970)
Reading at malicious_x = 0xffffffffffdfed8b... Unclear: 0x20=’ ’ score=999 (second best: 0x75 score=971)
Reading at malicious_x = 0xffffffffffdfed8c... Unclear: 0x53=’S’ score=998 (second best: 0x69 score=971)
Reading at malicious_x = 0xffffffffffdfed8d... Unclear: 0x71=’q’ score=998 (second best: 0xBD score=975)
Reading at malicious_x = 0xffffffffffdfed8e... Unclear: 0x75=’u’ score=998 (second best: 0xBC score=969)
Reading at malicious_x = 0xffffffffffdfed8f... Unclear: 0x65=’e’ score=999 (second best: 0x9B score=971)
Reading at malicious_x = 0xffffffffffdfed90... Unclear: 0x61=’a’ score=998 (second best: 0x74 score=975)
Reading at malicious_x = 0xffffffffffdfed91... Unclear: 0x6D=’m’ score=997 (second best: 0x11 score=968)
Reading at malicious_x = 0xffffffffffdfed92... Unclear: 0x69=’i’ score=999 (second best: 0xB7 score=970)
Reading at malicious_x = 0xffffffffffdfed93... Unclear: 0x73=’s’ score=996 (second best: 0xB1 score=972)
Reading at malicious_x = 0xffffffffffdfed94... Unclear: 0x68=’h’ score=999 (second best: 0xEF score=972)
Reading at malicious_x = 0xffffffffffdfed95... Unclear: 0x20=’ ’ score=997 (second best: 0xC8 score=978)
Reading at malicious_x = 0xffffffffffdfed96... Unclear: 0x4F=’O’ score=999 (second best: 0xC7 score=969)
Reading at malicious_x = 0xffffffffffdfed97... Unclear: 0x73=’s’ score=999 (second best: 0x5F score=972)
Reading at malicious_x = 0xffffffffffdfed98... Unclear: 0x73=’s’ score=997 (second best: 0x7F score=965)
Reading at malicious_x = 0xffffffffffdfed99... Unclear: 0x69=’i’ score=998 (second best: 0xB7 score=976)
Reading at malicious_x = 0xffffffffffdfed9a... Unclear: 0x66=’f’ score=998 (second best: 0x87 score=971)
Reading at malicious_x = 0xffffffffffdfed9b... Unclear: 0x72=’r’ score=997 (second best: 0xA6 score=973)
Reading at malicious_x = 0xffffffffffdfed9c... Unclear: 0x61=’a’ score=999 (second best: 0x36 score=975)
Reading at malicious_x = 0xffffffffffdfed9d... Unclear: 0x67=’g’ score=994 (second best: 0xB7 score=968)
Reading at malicious_x = 0xffffffffffdfed9e... Unclear: 0x65=’e’ score=998 (second best: 0xAC score=973)
Reading at malicious_x = 0xffffffffffdfed9f... Unclear: 0x2E=’.’ score=997 (second best: 0xB8 score=977)
@rich0
Copy link

rich0 commented Jan 5, 2018

CPU:
vendor_id : AuthenticAMD
cpu family : 23
model : 1
model name : AMD Ryzen 5 1600 Six-Core Processor
stepping : 1
microcode : 0x8001126
cpu MHz : 3200.000
cache size : 512 KB

Results:
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee18... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfee19... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfee1a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee1b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee1c... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfee1d... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee1e... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfee1f... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee20... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfee21... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee22... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfee23... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfee24... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee25... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfee26... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee27... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee28... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee29... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee2a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee2b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee2c... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfee2d... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfee2e... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfee2f... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee30... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee31... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfee32... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee33... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee34... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfee35... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee36... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfee37... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee38... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee39... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee3a... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfee3b... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee3c... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee3d... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfee3e... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee3f... Success: 0x2E=’.’ score=2

@rich0
Copy link

rich0 commented Jan 5, 2018

CPU:
vendor_id : AuthenticAMD
cpu family : 16
model : 4
model name : AMD Athlon(tm) II X4 555 Processor
stepping : 3
microcode : 0x10000c8
cpu MHz : 1500.000
cache size : 512 KB

Result:
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee18... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfee19... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfee1a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee1b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee1c... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfee1d... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee1e... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfee1f... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee20... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfee21... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee22... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfee23... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfee24... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee25... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfee26... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee27... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee28... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee29... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee2a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee2b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee2c... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfee2d... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfee2e... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfee2f... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee30... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee31... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfee32... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee33... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee34... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfee35... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee36... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfee37... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee38... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee39... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee3a... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfee3b... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee3c... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee3d... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfee3e... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee3f... Success: 0x2E=’.’ score=2

@crozone
Copy link
Owner Author

crozone commented Jan 5, 2018

OS:

Windows 10 17046.rs_prerelease

Windows Subsystem for Linux: Linux 4.4.0-43-Microsoft #1-Microsoft Wed Dec 31 14:42:53 PST 2014 x86_64 x86_64 x86_64 GNU/Linux

CPU

vendor_id       : GenuineIntel
cpu family      : 6
model           : 158
model name      : Intel(R) Core(TM) i7-7700K CPU @ 4.20GHz
stepping        : 9
microcode       : 0xffffffff
cpu MHz         : 4200.000
cache size      : 256 KB

Results (CACHE_HIT_THRESHOLD = 80):

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Unclear: 0x54=’T’ score=994 (second best: 0x00 score=569)
Reading at malicious_x = 0xffffffffffdfebb9... Unclear: 0x68=’h’ score=997 (second best: 0x00 score=556)
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=849 (second best: 0x01 score=422)
Reading at malicious_x = 0xffffffffffdfebbb... Unclear: 0x20=’ ’ score=992 (second best: 0x01 score=555)
Reading at malicious_x = 0xffffffffffdfebbc... Unclear: 0x4D=’M’ score=992 (second best: 0x00 score=558)
Reading at malicious_x = 0xffffffffffdfebbd... Unclear: 0x61=’a’ score=986 (second best: 0x01 score=560)
Reading at malicious_x = 0xffffffffffdfebbe... Unclear: 0x67=’g’ score=998 (second best: 0x00 score=572)
Reading at malicious_x = 0xffffffffffdfebbf... Unclear: 0x69=’i’ score=999 (second best: 0x01 score=560)
Reading at malicious_x = 0xffffffffffdfebc0... Unclear: 0x63=’c’ score=993 (second best: 0x00 score=571)
Reading at malicious_x = 0xffffffffffdfebc1... Unclear: 0x20=’ ’ score=997 (second best: 0x01 score=607)
Reading at malicious_x = 0xffffffffffdfebc2... Unclear: 0x57=’W’ score=988 (second best: 0x01 score=569)
Reading at malicious_x = 0xffffffffffdfebc3... Unclear: 0x6F=’o’ score=995 (second best: 0x01 score=586)
Reading at malicious_x = 0xffffffffffdfebc4... Unclear: 0x72=’r’ score=998 (second best: 0x00 score=553)
Reading at malicious_x = 0xffffffffffdfebc5... Unclear: 0x64=’d’ score=983 (second best: 0x00 score=582)
Reading at malicious_x = 0xffffffffffdfebc6... Unclear: 0x73=’s’ score=995 (second best: 0x00 score=574)
Reading at malicious_x = 0xffffffffffdfebc7... Unclear: 0x20=’ ’ score=988 (second best: 0x00 score=560)
Reading at malicious_x = 0xffffffffffdfebc8... Unclear: 0x61=’a’ score=997 (second best: 0x00 score=555)
Reading at malicious_x = 0xffffffffffdfebc9... Unclear: 0x72=’r’ score=998 (second best: 0x00 score=572)
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=133 (second best: 0x05 score=64)
Reading at malicious_x = 0xffffffffffdfebcb... Unclear: 0x20=’ ’ score=991 (second best: 0x01 score=561)
Reading at malicious_x = 0xffffffffffdfebcc... Unclear: 0x53=’S’ score=999 (second best: 0x01 score=553)
Reading at malicious_x = 0xffffffffffdfebcd... Unclear: 0x71=’q’ score=983 (second best: 0x00 score=555)
Reading at malicious_x = 0xffffffffffdfebce... Unclear: 0x75=’u’ score=994 (second best: 0x01 score=557)
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=127 (second best: 0x01 score=61)
Reading at malicious_x = 0xffffffffffdfebd0... Unclear: 0x61=’a’ score=978 (second best: 0x00 score=579)
Reading at malicious_x = 0xffffffffffdfebd1... Unclear: 0x6D=’m’ score=990 (second best: 0x00 score=570)
Reading at malicious_x = 0xffffffffffdfebd2... Unclear: 0x69=’i’ score=997 (second best: 0x00 score=561)
Reading at malicious_x = 0xffffffffffdfebd3... Unclear: 0x73=’s’ score=999 (second best: 0x00 score=560)
Reading at malicious_x = 0xffffffffffdfebd4... Unclear: 0x68=’h’ score=996 (second best: 0x00 score=546)
Reading at malicious_x = 0xffffffffffdfebd5... Unclear: 0x20=’ ’ score=994 (second best: 0x01 score=571)
Reading at malicious_x = 0xffffffffffdfebd6... Unclear: 0x4F=’O’ score=981 (second best: 0x00 score=559)
Reading at malicious_x = 0xffffffffffdfebd7... Unclear: 0x73=’s’ score=997 (second best: 0x00 score=552)
Reading at malicious_x = 0xffffffffffdfebd8... Unclear: 0x73=’s’ score=995 (second best: 0x00 score=541)
Reading at malicious_x = 0xffffffffffdfebd9... Unclear: 0x69=’i’ score=993 (second best: 0x00 score=557)
Reading at malicious_x = 0xffffffffffdfebda... Unclear: 0x66=’f’ score=973 (second best: 0x01 score=547)
Reading at malicious_x = 0xffffffffffdfebdb... Unclear: 0x72=’r’ score=997 (second best: 0x00 score=557)
Reading at malicious_x = 0xffffffffffdfebdc... Unclear: 0x61=’a’ score=993 (second best: 0x01 score=571)
Reading at malicious_x = 0xffffffffffdfebdd... Unclear: 0x67=’g’ score=998 (second best: 0x01 score=563)
Reading at malicious_x = 0xffffffffffdfebde... Success: 0x65=’e’ score=851 (second best: 0x01 score=423)
Reading at malicious_x = 0xffffffffffdfebdf... Unclear: 0x2E=’.’ score=996 (second best: 0x00 score=562)

@albiorix
Copy link

albiorix commented Jan 5, 2018

OS
Fedora 27 Linux 4.14.8-300.fc27.x86_64 #1 SMP

CPU
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 158
model name : Intel(R) Core(TM) i3-8350K CPU @ 4.00GHz
stepping : 11
microcode : 0x72
cpu MHz : 4000.000
cache size : 8192 KB

RESULT (CACHE_HIT_THRESHOLD 80)
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdffac0... Unclear: 0x54=’T’ score=993 (second best: 0x01 score=753)
Reading at malicious_x = 0xffffffffffdffac1... Unclear: 0x68=’h’ score=997 (second best: 0x01 score=786)
Reading at malicious_x = 0xffffffffffdffac2... Unclear: 0x65=’e’ score=999 (second best: 0x01 score=812)
Reading at malicious_x = 0xffffffffffdffac3... Unclear: 0x20=’ ’ score=999 (second best: 0x01 score=763)
Reading at malicious_x = 0xffffffffffdffac4... Unclear: 0x4D=’M’ score=997 (second best: 0x01 score=777)
Reading at malicious_x = 0xffffffffffdffac5... Unclear: 0x61=’a’ score=999 (second best: 0x01 score=772)
Reading at malicious_x = 0xffffffffffdffac6... Unclear: 0x67=’g’ score=998 (second best: 0x01 score=808)
Reading at malicious_x = 0xffffffffffdffac7... Unclear: 0x69=’i’ score=998 (second best: 0x01 score=813)
Reading at malicious_x = 0xffffffffffdffac8... Unclear: 0x63=’c’ score=995 (second best: 0x01 score=774)
Reading at malicious_x = 0xffffffffffdffac9... Unclear: 0x20=’ ’ score=997 (second best: 0x01 score=807)
Reading at malicious_x = 0xffffffffffdffaca... Unclear: 0x57=’W’ score=999 (second best: 0x01 score=814)
Reading at malicious_x = 0xffffffffffdffacb... Unclear: 0x6F=’o’ score=998 (second best: 0x01 score=782)
Reading at malicious_x = 0xffffffffffdffacc... Unclear: 0x72=’r’ score=999 (second best: 0x01 score=801)
Reading at malicious_x = 0xffffffffffdffacd... Unclear: 0x64=’d’ score=999 (second best: 0x01 score=795)
Reading at malicious_x = 0xffffffffffdfface... Unclear: 0x73=’s’ score=999 (second best: 0x01 score=821)
Reading at malicious_x = 0xffffffffffdffacf... Unclear: 0x20=’ ’ score=999 (second best: 0x01 score=791)
Reading at malicious_x = 0xffffffffffdffad0... Unclear: 0x61=’a’ score=999 (second best: 0x01 score=790)
Reading at malicious_x = 0xffffffffffdffad1... Unclear: 0x72=’r’ score=999 (second best: 0x01 score=800)
Reading at malicious_x = 0xffffffffffdffad2... Unclear: 0x65=’e’ score=999 (second best: 0x01 score=786)
Reading at malicious_x = 0xffffffffffdffad3... Unclear: 0x20=’ ’ score=998 (second best: 0x01 score=792)
Reading at malicious_x = 0xffffffffffdffad4... Unclear: 0x53=’S’ score=999 (second best: 0x01 score=773)
Reading at malicious_x = 0xffffffffffdffad5... Unclear: 0x71=’q’ score=999 (second best: 0x01 score=799)
Reading at malicious_x = 0xffffffffffdffad6... Unclear: 0x75=’u’ score=999 (second best: 0x01 score=770)
Reading at malicious_x = 0xffffffffffdffad7... Unclear: 0x65=’e’ score=999 (second best: 0x01 score=786)
Reading at malicious_x = 0xffffffffffdffad8... Unclear: 0x61=’a’ score=999 (second best: 0x01 score=761)
Reading at malicious_x = 0xffffffffffdffad9... Unclear: 0x6D=’m’ score=999 (second best: 0x01 score=787)
Reading at malicious_x = 0xffffffffffdffada... Unclear: 0x69=’i’ score=998 (second best: 0x01 score=789)
Reading at malicious_x = 0xffffffffffdffadb... Unclear: 0x73=’s’ score=999 (second best: 0x01 score=802)
Reading at malicious_x = 0xffffffffffdffadc... Unclear: 0x68=’h’ score=998 (second best: 0x01 score=761)
Reading at malicious_x = 0xffffffffffdffadd... Unclear: 0x20=’ ’ score=998 (second best: 0x01 score=767)
Reading at malicious_x = 0xffffffffffdffade... Unclear: 0x4F=’O’ score=999 (second best: 0x01 score=781)
Reading at malicious_x = 0xffffffffffdffadf... Unclear: 0x73=’s’ score=999 (second best: 0x01 score=794)
Reading at malicious_x = 0xffffffffffdffae0... Unclear: 0x73=’s’ score=999 (second best: 0x01 score=806)
Reading at malicious_x = 0xffffffffffdffae1... Unclear: 0x69=’i’ score=999 (second best: 0x01 score=801)
Reading at malicious_x = 0xffffffffffdffae2... Unclear: 0x66=’f’ score=999 (second best: 0x01 score=798)
Reading at malicious_x = 0xffffffffffdffae3... Unclear: 0x72=’r’ score=999 (second best: 0x01 score=797)
Reading at malicious_x = 0xffffffffffdffae4... Unclear: 0x61=’a’ score=999 (second best: 0x01 score=799)
Reading at malicious_x = 0xffffffffffdffae5... Unclear: 0x67=’g’ score=999 (second best: 0x01 score=804)
Reading at malicious_x = 0xffffffffffdffae6... Unclear: 0x65=’e’ score=999 (second best: 0x01 score=792)
Reading at malicious_x = 0xffffffffffdffae7... Unclear: 0x2E=’.’ score=999 (second best: 0x01 score=778)

@AmansRevenger
Copy link

OS:
Linux 4.4.0-103-generic #126-Ubuntu SMP

CPU:

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 60
model name	: Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz
stepping	: 3
microcode	: 0x19
cpu MHz		: 902.062
cache size	: 6144 KB

RESULT (CACHE_HIT_THRESHOLD 80):

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x68=’h’ score=7 (second best: 0x6A score=1)
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebbc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebc0... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfebc1... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfebc3... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfebc4... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebc5... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfebc6... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebc7... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebc9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebcb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebcc... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfebcd... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfebce... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebd0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebd1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfebd2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebd3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd4... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebd5... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebd6... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfebd7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd9... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebda... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfebdb... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebdc... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebdd... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebde... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebdf... Success: 0x2E=’.’ score=2 

@leni536
Copy link
Contributor

leni536 commented Jan 5, 2018

Using my pull request (#2).

OS:

Linux 4.13.0-1-amd64 #1 SMP Debian 4.13.10-1 (2017-10-30) x86_64 GNU/Linux

CPU:

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 15
model name	: Intel(R) Core(TM)2 CPU         T7200  @ 2.00GHz
stepping	: 6
microcode	: 0xc7
cpu MHz		: 1995.125
cache size	: 4096 KB

RESULT (CACHE_HIT_TRESHOLD 80):

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfecd8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfecd9... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfecda... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfecdb... Success: 0x20=’ ’ score=1 
Reading at malicious_x = 0xffffffffffdfecdc... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfecdd... Success: 0x61=’a’ score=7 (second best: 0x03 score=1)
Reading at malicious_x = 0xffffffffffdfecde... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfecdf... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfece0... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfece1... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfece2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfece3... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfece4... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfece5... Success: 0x64=’d’ score=1 
Reading at malicious_x = 0xffffffffffdfece6... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfece7... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfece8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfece9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfecea... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfeceb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfecec... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfeced... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfecee... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfecef... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfecf0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfecf1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfecf2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfecf3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfecf4... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfecf5... Success: 0x20=’ ’ score=1 
Reading at malicious_x = 0xffffffffffdfecf6... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfecf7... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfecf8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfecf9... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfecfa... Success: 0x66=’f’ score=1 
Reading at malicious_x = 0xffffffffffdfecfb... Success: 0x72=’r’ score=1 
Reading at malicious_x = 0xffffffffffdfecfc... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfecfd... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfecfe... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfecff... Success: 0x2E=’.’ score=2 

Doesn't seem a robust as other CPU's result, the vulnerability is clearly there though.

@ZanderBrown
Copy link

OS

Linux [hostname] 4.14.11-300.fc27.x86_64 #1 SMP Wed Jan 3 13:52:28 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

CPU

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 76
model name	: Intel(R) Pentium(R) CPU  N3710  @ 1.60GHz
stepping	: 4
microcode	: 0x408
cpu MHz		: 1600.000
cache size	: 1024 KB
physical id	: 0
siblings	: 4
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 11
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology tsc_reliable nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm sse4_1 sse4_2 movbe popcnt tsc_deadline_timer aes rdrand lahf_lm 3dnowprefetch epb pti tpr_shadow vnmi flexpriority ept vpid tsc_adjust smep erms dtherm ida arat
bugs		: cpu_insecure
bogomips	: 3200.00
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

Result #define CACHE_HIT_THRESHOLD (80)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdffac0... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdffac1... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdffac2... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffac3... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffac4... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdffac5... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffac6... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdffac7... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffac8... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdffac9... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffaca... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdffacb... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdffacc... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffacd... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfface... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffacf... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffad0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffad1... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffad2... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffad3... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffad4... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdffad5... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdffad6... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdffad7... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffad8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffad9... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdffada... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffadb... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffadc... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdffadd... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffade... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdffadf... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffae0... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffae1... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffae2... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdffae3... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffae4... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffae5... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdffae6... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffae7... Success: 0x2E=’.’ score=2 

@Jigoku
Copy link

Jigoku commented Jan 5, 2018

CPU

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 21
model		: 2
model name	: AMD FX(tm)-8320 Eight-Core Processor
stepping	: 0
microcode	: 0x6000822
cpu MHz		: 1400.000
cache size	: 2048 KB
physical id	: 0
siblings	: 8
core id		: 0
cpu cores	: 4
apicid		: 16
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 popcnt aes xsave avx f16c lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs xop skinit wdt lwp fma4 tce nodeid_msr tbm topoext perfctr_core perfctr_nb cpb hw_pstate vmmcall bmi1 arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold
bugs		: fxsave_leak sysret_ss_attrs null_seg cpu_insecure
bogomips	: 6999.70
TLB size	: 1536 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 48 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate cpb eff_freq_ro

OS (slackware-current)

Linux darkstar.local.lan 4.14.11 #1 SMP Tue Jan 2 20:05:07 CST 2018 x86_64 AMD FX(tm)-8320 Eight-Core Processor AuthenticAMD GNU/Linux

Result

Using #define CACHE_HIT_THRESHOLD (300)
Default value of 80 results in Success: 0xFF=’?’ score=0

$ ./spectre.out 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfec00... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfec01... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfec02... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec03... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec04... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfec05... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec06... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfec07... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec08... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfec09... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec0a... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfec0b... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfec0c... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec0d... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfec0e... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec0f... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec10... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec11... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec12... Unclear: 0x65=’e’ score=999 (second best: 0x37 score=780)
Reading at malicious_x = 0xffffffffffdfec13... Success: 0x20=’ ’ score=27 (second best: 0xC3 score=11)
Reading at malicious_x = 0xffffffffffdfec14... Success: 0x53=’S’ score=31 (second best: 0xC4 score=13)
Reading at malicious_x = 0xffffffffffdfec15... Success: 0x71=’q’ score=11 (second best: 0x5F score=3)
Reading at malicious_x = 0xffffffffffdfec16... Success: 0x75=’u’ score=9 (second best: 0xEB score=2)
Reading at malicious_x = 0xffffffffffdfec17... Success: 0x65=’e’ score=9 (second best: 0xE5 score=2)
Reading at malicious_x = 0xffffffffffdfec18... Success: 0x61=’a’ score=9 (second best: 0xEE score=2)
Reading at malicious_x = 0xffffffffffdfec19... Success: 0x6D=’m’ score=9 (second best: 0xFA score=2)
Reading at malicious_x = 0xffffffffffdfec1a... Success: 0x69=’i’ score=9 (second best: 0x01 score=2)
Reading at malicious_x = 0xffffffffffdfec1b... Success: 0x73=’s’ score=9 (second best: 0xF7 score=2)
Reading at malicious_x = 0xffffffffffdfec1c... Success: 0x68=’h’ score=9 (second best: 0xEC score=2)
Reading at malicious_x = 0xffffffffffdfec1d... Success: 0x20=’ ’ score=9 (second best: 0xDC score=2)
Reading at malicious_x = 0xffffffffffdfec1e... Success: 0x4F=’O’ score=11 (second best: 0xF6 score=3)
Reading at malicious_x = 0xffffffffffdfec1f... Success: 0x73=’s’ score=9 (second best: 0x9A score=2)
Reading at malicious_x = 0xffffffffffdfec20... Success: 0x73=’s’ score=9 (second best: 0xF6 score=2)
Reading at malicious_x = 0xffffffffffdfec21... Success: 0x69=’i’ score=9 (second best: 0xE2 score=2)
Reading at malicious_x = 0xffffffffffdfec22... Success: 0x66=’f’ score=7 (second best: 0xFF score=1)
Reading at malicious_x = 0xffffffffffdfec23... Success: 0x72=’r’ score=9 (second best: 0xD2 score=2)
Reading at malicious_x = 0xffffffffffdfec24... Success: 0x61=’a’ score=9 (second best: 0xB5 score=2)
Reading at malicious_x = 0xffffffffffdfec25... Success: 0x67=’g’ score=9 (second best: 0xFC score=2)
Reading at malicious_x = 0xffffffffffdfec26... Success: 0x65=’e’ score=11 (second best: 0xE4 score=3)
Reading at malicious_x = 0xffffffffffdfec27... Success: 0x2E=’.’ score=11 (second best: 0x4B score=3)

@Djhg2000
Copy link

Djhg2000 commented Jan 5, 2018

OS (Debian Stretch)
Linux [hostname] 4.9.0-5-amd64 #1 SMP Debian 4.9.65-3+deb9u2 (2018-01-04) x86_64 GNU/Linux

CPU

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 42
model name	: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
stepping	: 7
microcode	: 0x28
cpu MHz		: 1677.795
cache size	: 8192 KB
physical id	: 0
siblings	: 8
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm epb kaiser tpr_shadow vnmi flexpriority ept vpid xsaveopt dtherm ida arat pln pts
bugs		:
bogomips	: 6793.25
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

Result #define CACHE_HIT_THRESHOLD (80)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfed68... Success: 0x54=’T’ score=61 (second best: 0x00 score=27)
Reading at malicious_x = 0xffffffffffdfed69... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfed6a... Success: 0x65=’e’ score=15 (second best: 0x00 score=2)
Reading at malicious_x = 0xffffffffffdfed6b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed6c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfed6d... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfed6e... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfed6f... Success: 0x69=’i’ score=13 (second best: 0x00 score=3)
Reading at malicious_x = 0xffffffffffdfed70... Success: 0x63=’c’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfed71... Success: 0x20=’ ’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfed72... Success: 0x57=’W’ score=25 (second best: 0x05 score=10)
Reading at malicious_x = 0xffffffffffdfed73... Success: 0x6F=’o’ score=11 (second best: 0x05 score=3)
Reading at malicious_x = 0xffffffffffdfed74... Success: 0x72=’r’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfed75... Success: 0x64=’d’ score=15 (second best: 0x00 score=2)
Reading at malicious_x = 0xffffffffffdfed76... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed77... Success: 0x20=’ ’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfed78... Success: 0x61=’a’ score=15 (second best: 0x00 score=2)
Reading at malicious_x = 0xffffffffffdfed79... Success: 0x72=’r’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfed7a... Unclear: 0x65=’e’ score=55 (second best: 0x00 score=30)
Reading at malicious_x = 0xffffffffffdfed7b... Success: 0x20=’ ’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfed7c... Success: 0x53=’S’ score=27 (second best: 0x00 score=12)
Reading at malicious_x = 0xffffffffffdfed7d... Success: 0x71=’q’ score=15 (second best: 0x00 score=2)
Reading at malicious_x = 0xffffffffffdfed7e... Success: 0x75=’u’ score=13 (second best: 0x05 score=4)
Reading at malicious_x = 0xffffffffffdfed7f... Success: 0x65=’e’ score=11 (second best: 0x05 score=3)
Reading at malicious_x = 0xffffffffffdfed80... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfed81... Success: 0x6D=’m’ score=61 (second best: 0x00 score=27)
Reading at malicious_x = 0xffffffffffdfed82... Success: 0x69=’i’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfed83... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed84... Success: 0x68=’h’ score=67 (second best: 0x00 score=24)
Reading at malicious_x = 0xffffffffffdfed85... Success: 0x20=’ ’ score=77 (second best: 0x05 score=36)
Reading at malicious_x = 0xffffffffffdfed86... Success: 0x4F=’O’ score=51 (second best: 0x00 score=16)
Reading at malicious_x = 0xffffffffffdfed87... Success: 0x73=’s’ score=27 (second best: 0x00 score=12)
Reading at malicious_x = 0xffffffffffdfed88... Success: 0x73=’s’ score=13 (second best: 0x05 score=4)
Reading at malicious_x = 0xffffffffffdfed89... Success: 0x69=’i’ score=91 (second best: 0x05 score=43)
Reading at malicious_x = 0xffffffffffdfed8a... Success: 0x66=’f’ score=29 (second best: 0x05 score=12)
Reading at malicious_x = 0xffffffffffdfed8b... Unclear: 0x72=’r’ score=7 (second best: 0x00 score=6)
Reading at malicious_x = 0xffffffffffdfed8c... Success: 0x61=’a’ score=11 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfed8d... Unclear: 0x67=’g’ score=37 (second best: 0x00 score=23)
Reading at malicious_x = 0xffffffffffdfed8e... Success: 0x65=’e’ score=11 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfed8f... Success: 0x2E=’.’ score=11 (second best: 0x00 score=4)

@Djhg2000
Copy link

Djhg2000 commented Jan 5, 2018

OS (Debian Sid 2018-01-05)
Linux [hostname] 4.15.0-rc6 #1 SMP PREEMPT Tue Jan 2 09:48:19 CET 2018 x86_64 GNU/Linux

CPU

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 23
model		: 1
model name	: AMD Ryzen 5 1400 Quad-Core Processor
stepping	: 1
microcode	: 0x8001129
cpu MHz		: 1442.232
cache size	: 512 KB
physical id	: 0
siblings	: 8
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb hw_pstate sme vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 xsaves clzero irperf xsaveerptr arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif overflow_recov succor smca
bugs		: sysret_ss_attrs null_seg cpu_insecure
bogomips	: 6387.03
TLB size	: 2560 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 43 bits physical, 48 bits virtual
power management: ts ttp tm hwpstate eff_freq_ro [13] [14]

Result #define CACHE_HIT_THRESHOLD (80)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfecf8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfecf9... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfecfa... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfecfb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfecfc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfecfd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfecfe... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfecff... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfed00... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfed01... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed02... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfed03... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfed04... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfed05... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfed06... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed07... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed08... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfed09... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfed0a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfed0b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed0c... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfed0d... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfed0e... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfed0f... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfed10... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfed11... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfed12... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfed13... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed14... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfed15... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed16... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfed17... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed18... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed19... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfed1a... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfed1b... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfed1c... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfed1d... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfed1e... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfed1f... Success: 0x2E=’.’ score=2

Am I reading the output wrong or is this R5-1400 more susceptible to Spectre than my i7-2600 above?

Edit:
I forgot to switch back from my self-compiled kernel with realtime scheduler to the Debian provided kernel before running the sets, however the result seems to remain unchanged. New tests using the Debian kernel appended below for completeness:

OS (Debian Sid 2018-01-05)
Linux [hostname] 4.14.0-2-amd64 #1 SMP Debian 4.14.7-1 (2017-12-22) x86_64 GNU/Linux

CPU

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 23
model		: 1
model name	: AMD Ryzen 5 1400 Quad-Core Processor
stepping	: 1
microcode	: 0x8001129
cpu MHz		: 1550.000
cache size	: 512 KB
physical id	: 0
siblings	: 8
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb hw_pstate sme vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 xsaves clzero irperf arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif overflow_recov succor smca
bugs		: fxsave_leak sysret_ss_attrs null_seg
bogomips	: 6387.51
TLB size	: 2560 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 43 bits physical, 48 bits virtual
power management: ts ttp tm hwpstate eff_freq_ro [13] [14]

Result #define CACHE_HIT_THRESHOLD (80)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfecf8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfecf9... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfecfa... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfecfb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfecfc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfecfd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfecfe... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfecff... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfed00... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfed01... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed02... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfed03... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfed04... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfed05... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfed06... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed07... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed08... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfed09... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfed0a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfed0b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed0c... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfed0d... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfed0e... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfed0f... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfed10... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfed11... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfed12... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfed13... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed14... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfed15... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfed16... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfed17... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed18... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfed19... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfed1a... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfed1b... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfed1c... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfed1d... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfed1e... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfed1f... Success: 0x2E=’.’ score=2

@h3adshotzz
Copy link

OS

Darwin h3adsh0tzzs-MBP.home 16.7.0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 x86_64

CPU

machdep.cpu.brand_string: Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz

Result #define CACHE_HIT_THRESHOLD (80)

Reading 40 bytes:
Reading at malicious_x = 0xfffffffffffffebe... Unclear: 0x54==’T’ score=995 (second best: 0x02 score=679)
Reading at malicious_x = 0xfffffffffffffebf... Unclear: 0x68==’h’ score=996 (second best: 0x02 score=880)
Reading at malicious_x = 0xfffffffffffffec0... Unclear: 0x65==’e’ score=994 (second best: 0x02 score=899)
Reading at malicious_x = 0xfffffffffffffec1... Unclear: 0x20==’ ’ score=979 (second best: 0x02 score=895)
Reading at malicious_x = 0xfffffffffffffec2... Unclear: 0x4D==’M’ score=995 (second best: 0x02 score=909)
Reading at malicious_x = 0xfffffffffffffec3... Success: 0x61==’a’ score=2
Reading at malicious_x = 0xfffffffffffffec4... Success: 0x67==’g’ score=631 (second best: 0x02 score=313)
Reading at malicious_x = 0xfffffffffffffec5... Unclear: 0x69==’i’ score=992 (second best: 0x02 score=895)
Reading at malicious_x = 0xfffffffffffffec6... Success: 0x63==’c’ score=895 (second best: 0x02 score=445)
Reading at malicious_x = 0xfffffffffffffec7... Unclear: 0x20==’ ’ score=981 (second best: 0x02 score=891)
Reading at malicious_x = 0xfffffffffffffec8... Unclear: 0x57==’W’ score=988 (second best: 0x02 score=877)
Reading at malicious_x = 0xfffffffffffffec9... Success: 0x6F==’o’ score=65 (second best: 0x02 score=30)
Reading at malicious_x = 0xfffffffffffffeca... Unclear: 0x72==’r’ score=998 (second best: 0x02 score=760)
Reading at malicious_x = 0xfffffffffffffecb... Unclear: 0x64==’d’ score=993 (second best: 0x02 score=691)
Reading at malicious_x = 0xfffffffffffffecc... Unclear: 0x73==’s’ score=993 (second best: 0x02 score=708)
Reading at malicious_x = 0xfffffffffffffecd... Success: 0x20==’ ’ score=2
Reading at malicious_x = 0xfffffffffffffece... Unclear: 0x61==’a’ score=989 (second best: 0x02 score=825)
Reading at malicious_x = 0xfffffffffffffecf... Unclear: 0x72==’r’ score=996 (second best: 0x02 score=889)
Reading at malicious_x = 0xfffffffffffffed0... Unclear: 0x65==’e’ score=986 (second best: 0x02 score=854)
Reading at malicious_x = 0xfffffffffffffed1... Unclear: 0x20==’ ’ score=973 (second best: 0x02 score=787)
Reading at malicious_x = 0xfffffffffffffed2... Unclear: 0x53==’S’ score=989 (second best: 0x02 score=721)
Reading at malicious_x = 0xfffffffffffffed3... Unclear: 0x71==’q’ score=988 (second best: 0x02 score=800)
Reading at malicious_x = 0xfffffffffffffed4... Unclear: 0x75==’u’ score=981 (second best: 0x02 score=789)
Reading at malicious_x = 0xfffffffffffffed5... Success: 0x65==’e’ score=11 (second best: 0x01 score=3)
Reading at malicious_x = 0xfffffffffffffed6... Success: 0x61==’a’ score=2
Reading at malicious_x = 0xfffffffffffffed7... Unclear: 0x6D==’m’ score=981 (second best: 0x02 score=798)
Reading at malicious_x = 0xfffffffffffffed8... Unclear: 0x69==’i’ score=989 (second best: 0x02 score=799)
Reading at malicious_x = 0xfffffffffffffed9... Success: 0x73==’s’ score=15 (second best: 0x02 score=5)
Reading at malicious_x = 0xfffffffffffffeda... Unclear: 0x68==’h’ score=994 (second best: 0x02 score=822)
Reading at malicious_x = 0xfffffffffffffedb... Unclear: 0x20==’ ’ score=944 (second best: 0x02 score=758)
Reading at malicious_x = 0xfffffffffffffedc... Success: 0x4F==’O’ score=2
Reading at malicious_x = 0xfffffffffffffedd... Unclear: 0x73==’s’ score=988 (second best: 0x02 score=754)
Reading at malicious_x = 0xfffffffffffffede... Success: 0x73==’s’ score=2
Reading at malicious_x = 0xfffffffffffffedf... Success: 0x69==’i’ score=2
Reading at malicious_x = 0xfffffffffffffee0... Success: 0x66==’f’ score=7 (second best: 0x71 score=1)
Reading at malicious_x = 0xfffffffffffffee1... Success: 0x72==’r’ score=2
Reading at malicious_x = 0xfffffffffffffee2... Success: 0x61==’a’ score=2
Reading at malicious_x = 0xfffffffffffffee3... Unclear: 0x67==’g’ score=980 (second best: 0x02 score=756)
Reading at malicious_x = 0xfffffffffffffee4... Unclear: 0x65==’e’ score=935 (second best: 0x02 score=865)
Reading at malicious_x = 0xfffffffffffffee5... Unclear: 0x2E==’.’ score=931 (second best: 0x02 score=743)

@jmsundar
Copy link

jmsundar commented Jan 6, 2018

OS

Darwin Kernel Version 17.3.0: Thu Nov  9 18:09:22 PST 2017; root:xnu-570.31.3~1/RELEASE_X86_64 x86_64

CPU

machdep.cpu.vendor: GenuineIntel
machdep.cpu.brand_string: Intel(R) Core(TM) i7-4770HQ CPU @ 2.20GHz
machdep.cpu.family: 6
machdep.cpu.model: 70
machdep.cpu.stepping: 1
machdep.cpu.microcode_version: 19
machdep.cpu.cache.linesize: 64
machdep.cpu.cache.L2_associativity: 8
machdep.cpu.cache.size: 256

Results (CACHE_HIT_THRESHOLD = 80)

Reading 40 bytes:
Reading at malicious_x = 0xfffffffffffffebe... Success: 0x54=’T’ score=17 (second best: 0x01 score=6)
Reading at malicious_x = 0xfffffffffffffebf... Unclear: 0x68=’h’ score=997 (second best: 0x02 score=879)
Reading at malicious_x = 0xfffffffffffffec0... Unclear: 0x65=’e’ score=996 (second best: 0x02 score=839)
Reading at malicious_x = 0xfffffffffffffec1... Unclear: 0x20=’ ’ score=998 (second best: 0x02 score=834)
Reading at malicious_x = 0xfffffffffffffec2... Success: 0x4D=’M’ score=891 (second best: 0x02 score=443)
Reading at malicious_x = 0xfffffffffffffec3... Unclear: 0x61=’a’ score=999 (second best: 0x02 score=925)
Reading at malicious_x = 0xfffffffffffffec4... Unclear: 0x67=’g’ score=998 (second best: 0x02 score=912)
Reading at malicious_x = 0xfffffffffffffec5... Success: 0x69=’i’ score=9 (second best: 0x02 score=2)
Reading at malicious_x = 0xfffffffffffffec6... Success: 0x63=’c’ score=119 (second best: 0x02 score=57)
Reading at malicious_x = 0xfffffffffffffec7... Unclear: 0x20=’ ’ score=999 (second best: 0x02 score=926)
Reading at malicious_x = 0xfffffffffffffec8... Unclear: 0x57=’W’ score=996 (second best: 0x02 score=909)
Reading at malicious_x = 0xfffffffffffffec9... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xfffffffffffffeca... Unclear: 0x72=’r’ score=997 (second best: 0x02 score=893)
Reading at malicious_x = 0xfffffffffffffecb... Unclear: 0x64=’d’ score=998 (second best: 0x02 score=887)
Reading at malicious_x = 0xfffffffffffffecc... Unclear: 0x73=’s’ score=999 (second best: 0x02 score=845)
Reading at malicious_x = 0xfffffffffffffecd... Unclear: 0x20=’ ’ score=992 (second best: 0x02 score=904)
Reading at malicious_x = 0xfffffffffffffece... Unclear: 0x61=’a’ score=998 (second best: 0x02 score=909)
Reading at malicious_x = 0xfffffffffffffecf... Unclear: 0x72=’r’ score=999 (second best: 0x02 score=708)
Reading at malicious_x = 0xfffffffffffffed0... Unclear: 0x65=’e’ score=998 (second best: 0x02 score=914)
Reading at malicious_x = 0xfffffffffffffed1... Success: 0x20=’ ’ score=9 (second best: 0x01 score=2)
Reading at malicious_x = 0xfffffffffffffed2... Unclear: 0x53=’S’ score=997 (second best: 0x02 score=823)
Reading at malicious_x = 0xfffffffffffffed3... Success: 0x71=’q’ score=45 (second best: 0x02 score=20)
Reading at malicious_x = 0xfffffffffffffed4... Unclear: 0x75=’u’ score=998 (second best: 0x02 score=905)
Reading at malicious_x = 0xfffffffffffffed5... Success: 0x65=’e’ score=15 (second best: 0x01 score=5)
Reading at malicious_x = 0xfffffffffffffed6... Unclear: 0x61=’a’ score=996 (second best: 0x02 score=903)
Reading at malicious_x = 0xfffffffffffffed7... Unclear: 0x6D=’m’ score=993 (second best: 0x02 score=707)
Reading at malicious_x = 0xfffffffffffffed8... Unclear: 0x69=’i’ score=999 (second best: 0x02 score=918)
Reading at malicious_x = 0xfffffffffffffed9... Unclear: 0x73=’s’ score=999 (second best: 0x02 score=912)
Reading at malicious_x = 0xfffffffffffffeda... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xfffffffffffffedb... Unclear: 0x20=’ ’ score=998 (second best: 0x02 score=878)
Reading at malicious_x = 0xfffffffffffffedc... Unclear: 0x4F=’O’ score=999 (second best: 0x02 score=919)
Reading at malicious_x = 0xfffffffffffffedd... Unclear: 0x73=’s’ score=999 (second best: 0x02 score=871)
Reading at malicious_x = 0xfffffffffffffede... Unclear: 0x73=’s’ score=998 (second best: 0x02 score=815)
Reading at malicious_x = 0xfffffffffffffedf... Unclear: 0x69=’i’ score=998 (second best: 0x02 score=901)
Reading at malicious_x = 0xfffffffffffffee0... Unclear: 0x66=’f’ score=999 (second best: 0x02 score=916)
Reading at malicious_x = 0xfffffffffffffee1... Success: 0x72=’r’ score=9 (second best: 0x02 score=2)
Reading at malicious_x = 0xfffffffffffffee2... Unclear: 0x61=’a’ score=998 (second best: 0x02 score=896)
Reading at malicious_x = 0xfffffffffffffee3... Unclear: 0x67=’g’ score=999 (second best: 0x02 score=901)
Reading at malicious_x = 0xfffffffffffffee4... Unclear: 0x65=’e’ score=997 (second best: 0x02 score=893)
Reading at malicious_x = 0xfffffffffffffee5... Unclear: 0x2E=’.’ score=998 (second best: 0x02 score=883)

@bog-dan-ro
Copy link

OS (Debian Testing)

Linux [hostname] 4.14.0-2-amd64 #1 SMP Debian 4.14.7-1 (2017-12-22) x86_64 GNU/Linux

CPU

vendor_id : AuthenticAMD
cpu family : 21
model : 2
model name : AMD Opteron(tm) Processor 6386 SE
stepping : 0
microcode : 0x600084f

Results #define CACHE_HIT_THRESHOLD (250)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfecf8... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfecf9... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfecfa... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfecfb... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfecfc... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfecfd... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfecfe... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfecff... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfed00... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfed01... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed02... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfed03... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfed04... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfed05... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfed06... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed07... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed08... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfed09... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfed0a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfed0b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed0c... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfed0d... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfed0e... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfed0f... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfed10... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfed11... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfed12... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfed13... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed14... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfed15... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed16... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfed17... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed18... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed19... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfed1a... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfed1b... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfed1c... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfed1d... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfed1e... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfed1f... Success: 0x2E=’.’ score=2

@ziacik
Copy link

ziacik commented Jan 6, 2018

With @progman patch from original gist and -march=core2 I got this, sometimes needed to run more times to get the correct results.

OS

Linux notebook 4.14.8-1-ARCH #1 SMP PREEMPT Wed Dec 20 21:27:44 UTC 2017 x86_64 GNU/Linux

CPU

vendor_id : GenuineIntel
cpu family : 6
model : 15
model name : Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz
stepping : 13
microcode : 0xa4

Result

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfed78... Success: 0x54=’T’ score=1
Reading at malicious_x = 0xffffffffffdfed79... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfed7a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfed7b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed7c... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfed7d... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfed7e... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfed7f... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfed80... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfed81... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed82... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfed83... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfed84... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfed85... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfed86... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed87... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed88... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfed89... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfed8a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfed8b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed8c... Success: 0x53=’S’ score=6 (second best: 0x03 score=1)
Reading at malicious_x = 0xffffffffffdfed8d... Success: 0x71=’q’ score=1
Reading at malicious_x = 0xffffffffffdfed8e... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfed8f... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfed90... Success: 0x61=’a’ score=3 (second best: 0x04 score=1)
Reading at malicious_x = 0xffffffffffdfed91... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfed92... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfed93... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed94... Success: 0x68=’h’ score=3 (second best: 0x03 score=1)
Reading at malicious_x = 0xffffffffffdfed95... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfed96... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfed97... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed98... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfed99... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfed9a... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfed9b... Success: 0x72=’r’ score=5 (second best: 0x03 score=1)
Reading at malicious_x = 0xffffffffffdfed9c... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfed9d... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfed9e... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfed9f... Success: 0x2E=’.’ score=2

@4goettma
Copy link

4goettma commented Jan 6, 2018

OS

Linux [hostname] 4.14.11-1-ARCH #1 SMP PREEMPT Wed Jan 3 07:02:42 UTC 2018 x86_64 GNU/Linux

CPU

vendor_id	: GenuineIntel
cpu family	: 6
model		: 60
model name	: Intel(R) Core(TM) i5-4210M CPU @ 2.60GHz
stepping	: 3
microcode	: 0x1c

Result

#define CACHE_HIT_THRESHOLD (24)
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfedc8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfedc9... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfedca... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfedcb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfedcc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfedcd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfedce... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfedcf... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfedd0... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfedd1... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfedd2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfedd3... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfedd4... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfedd5... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfedd6... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfedd7... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfedd8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfedd9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfedda... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfeddb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfeddc... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfeddd... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfedde... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfeddf... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfede0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfede1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfede2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfede3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfede4... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfede5... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfede6... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfede7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfede8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfede9... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfedea... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfedeb... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfedec... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfeded... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfedee... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfedef... Success: 0x2E=’.’ score=2

@notf0und
Copy link

notf0und commented Jan 7, 2018

OS

Linux [hostname] 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

CPU

vendor_id	: GenuineIntel
cpu family	: 6
model		: 42
model name	: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
stepping	: 7
microcode	: 0x29
cpu MHz		: 894.574
cache size	: 3072 KB

Results (CACHE_HIT_THRESHOLD = 80)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x68=’h’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebbc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebc0... Success: 0x63=’c’ score=11 (second best: 0x00 score=2)
Reading at malicious_x = 0xffffffffffdfebc1... Success: 0x20=’ ’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfebc2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfebc3... Success: 0x6F=’o’ score=155 (second best: 0x05 score=75)
Reading at malicious_x = 0xffffffffffdfebc4... Success: 0x72=’r’ score=7 
Reading at malicious_x = 0xffffffffffdfebc5... Success: 0x64=’d’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebc6... Success: 0x73=’s’ score=17 (second best: 0x05 score=6)
Reading at malicious_x = 0xffffffffffdfebc7... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebc9... Success: 0x72=’r’ score=9 (second best: 0x00 score=3)
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebcb... Success: 0x20=’ ’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfebcc... Success: 0x53=’S’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfebcd... Success: 0x71=’q’ score=301 (second best: 0x05 score=148)
Reading at malicious_x = 0xffffffffffdfebce... Success: 0x75=’u’ score=15 (second best: 0x05 score=5)
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=7 (second best: 0x86 score=1)
Reading at malicious_x = 0xffffffffffdfebd0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebd1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfebd2... Success: 0x69=’i’ score=97 (second best: 0x05 score=46)
Reading at malicious_x = 0xffffffffffdfebd3... Success: 0x73=’s’ score=17 (second best: 0x00 score=7)
Reading at malicious_x = 0xffffffffffdfebd4... Success: 0x68=’h’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfebd5... Success: 0x20=’ ’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebd6... Success: 0x4F=’O’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebd7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd9... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebda... Success: 0x66=’f’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebdb... Success: 0x72=’r’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebdc... Success: 0x61=’a’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebdd... Success: 0x67=’g’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebde... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebdf... Success: 0x2E=’.’ score=17 (second best: 0x05 score=6)

@MaferCJ
Copy link

MaferCJ commented Jan 7, 2018

OS

Linux [hostname] 4.14.0-2-amd64 #1 SMP Debian 4.14.7-1 (2017-12-22) x86_64 GNU/Linux

CPU

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 20
model		: 1
model name	: AMD C-50 Processor
stepping	: 0
microcode	: 0x5000029
cpu MHz		: 800.000
cache size	: 512 KB

Results (CACHE_HIT_THRESHOLD = 500)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfecf8... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfecf9... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfecfa... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfecfb... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfecfc... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfecfd... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfecfe... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfecff... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed00... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed01... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed02... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed03... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed04... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfed05... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed06... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed07... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed08... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed09... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed0a... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfed0b... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed0c... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed0d... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed0e... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed0f... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed10... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfed11... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfed12... Unclear: 0xFE=’?’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdfed13... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed14... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfed15... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed16... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfed17... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed18... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed19... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdfed1a... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed1b... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed1c... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed1d... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed1e... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdfed1f... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)

@andreaslink-de
Copy link

OS:

Linux 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

CPU:

vendor_id       : GenuineIntel
cpu family      : 6
model           : 26
model name      : Intel(R) Xeon(R) CPU           E5506  @ 2.13GHz
stepping        : 5
microcode       : 0x11
cpu MHz         : 1596.000
cache size      : 4096 KB
bugs            :
bogomips        : 4266.47
clflush size    : 64
cache_alignment : 64
address sizes   : 40 bits physical, 48 bits virtual

Result:

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x05=’?’ score=2
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=4 (second best: 0x05 score=2)
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x20=’ ’ score=7 (second best: 0x05 score=2)
Reading at malicious_x = 0xffffffffffdfebbc... Unclear: 0x21=’!’ score=3 (second best: 0xDE score=2)
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x61=’a’ score=8 (second best: 0x05 score=2)
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x67=’g’ score=1
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebc0... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebc1... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebc2... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebc3... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfebc4... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfebc5... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfebc6... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfebc7... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfebc8... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfebc9... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfebcb... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfebcc... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfebcd... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfebce... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfebd0... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfebd1... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfebd2... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfebd3... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfebd4... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfebd5... Success: 0x20=’ ’ score=1
Reading at malicious_x = 0xffffffffffdfebd6... Success: 0x4F=’O’ score=4 (second best: 0x21 score=1)
Reading at malicious_x = 0xffffffffffdfebd7... Success: 0x73=’s’ score=1
Reading at malicious_x = 0xffffffffffdfebd8... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebd9... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebda... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebdb... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebdc... Success: 0x21=’!’ score=1
Reading at malicious_x = 0xffffffffffdfebdd... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfebde... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfebdf... Success: 0x05=’?’ score=2

Hmm, does not seem to hit every letter correctly... interesting.

@LouisCyfer
Copy link

Kernel
Ubuntu 16.04 --> 4.4.0-104-generic

CPU

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 21
model		: 48
model name	: AMD Athlon(tm) X4 860K Quad Core Processor
stepping	: 1
microcode	: 0x6003106
cpu MHz		: 3693.171
cache size	: 2048 KB

Results with #define CACHE_HIT_THRESHOLD (221)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebbc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebc0... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfebc1... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfebc3... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfebc4... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebc5... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfebc6... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebc7... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebc9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebcb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebcc... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfebcd... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfebce... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebd0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebd1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfebd2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebd3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd4... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebd5... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebd6... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfebd7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd9... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebda... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfebdb... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebdc... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebdd... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebde... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebdf... Success: 0x2E=’.’ score=2

@iFA88
Copy link

iFA88 commented Jan 10, 2018

OS

Linux debian 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u5 (2017-09-19) x86_64 GNU/Linux

CPU

vendor_id	: AuthenticAMD
cpu family	: 23
model		: 1
model name	: AMD Ryzen 7 1700X Eight-Core Processor
stepping	: 1
microcode	: 0x6000626
cpu MHz		: 3393.624
cache size	: 512 KB

Result

root@debian:~# ./spectre 34
Using a cache hit threshold of 34.
Build: RDTSCP_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdff908... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdff909... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdff90a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdff90b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdff90c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdff90d... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdff90e... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdff90f... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdff910... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdff911... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdff912... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdff913... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdff914... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdff915... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdff916... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdff917... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdff918... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdff919... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdff91a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdff91b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdff91c... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdff91d... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdff91e... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdff91f... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdff920... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdff921... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdff922... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdff923... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdff924... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdff925... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdff926... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdff927... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdff928... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdff929... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdff92a... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdff92b... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdff92c... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdff92d... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdff92e... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdff92f... Success: 0x2E=’.’ score=2 

NOTE

With parameter 33 doesn't read the characters. This have executed in Windows10 with Oracle virtualbox

@mbb78
Copy link

mbb78 commented Jan 11, 2018

OS

4.14.12-1-MANJARO #1 SMP PREEMPT Sat Jan 6 21:03:39 UTC 2018 x86_64 GNU/Linux

CPU

vendor_id       : GenuineIntel
cpu family      : 6
model           : 58
model name      : Intel(R) Core(TM) i5-3427U CPU @ 1.80GHz
stepping        : 9
microcode       : 0x1c
cpu MHz         : 2294.808
cache size      : 3072 KB

Results (default THRESHOLD)

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee78... Success: 0x05=’?’ score=13 (second best: 0x54=’T’ score=4)
Reading at malicious_x = 0xffffffffffdfee79... Success: 0x00=’?’ score=5 (second best: 0x68=’h’ score=1)
Reading at malicious_x = 0xffffffffffdfee7a... Success: 0x65=’e’ score=343 (second best: 0x05=’?’ score=169)
Reading at malicious_x = 0xffffffffffdfee7b... Success: 0x20=’ ’ score=15 (second best: 0x00=’?’ score=7)
Reading at malicious_x = 0xffffffffffdfee7c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfee7d... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfee7e... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfee7f... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfee80... Success: 0x63=’c’ score=15 (second best: 0x00=’?’ score=7)
Reading at malicious_x = 0xffffffffffdfee81... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfee82... Success: 0x57=’W’ score=11 (second best: 0x00=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee83... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfee84... Success: 0x72=’r’ score=7 (second best: 0x05=’?’ score=1)                      
Reading at malicious_x = 0xffffffffffdfee85... Success: 0x64=’d’ score=2                                                      
Reading at malicious_x = 0xffffffffffdfee86... Success: 0x73=’s’ score=7 (second best: 0x05=’?’ score=1)                      
Reading at malicious_x = 0xffffffffffdfee87... Success: 0x20=’ ’ score=2                                                      
Reading at malicious_x = 0xffffffffffdfee88... Success: 0x61=’a’ score=2                                                      
Reading at malicious_x = 0xffffffffffdfee89... Success: 0x72=’r’ score=7 (second best: 0x05=’?’ score=1)                      
Reading at malicious_x = 0xffffffffffdfee8a... Success: 0x65=’e’ score=7 (second best: 0x05=’?’ score=1)                      
Reading at malicious_x = 0xffffffffffdfee8b... Success: 0x20=’ ’ score=2                                                      
Reading at malicious_x = 0xffffffffffdfee8c... Success: 0x53=’S’ score=7 (second best: 0x05=’?’ score=1)                      
Reading at malicious_x = 0xffffffffffdfee8d... Success: 0x71=’q’ score=2                                                      
Reading at malicious_x = 0xffffffffffdfee8e... Success: 0x75=’u’ score=7 (second best: 0x05=’?’ score=1)                      
Reading at malicious_x = 0xffffffffffdfee8f... Success: 0x65=’e’ score=7 (second best: 0x05=’?’ score=1)                      
Reading at malicious_x = 0xffffffffffdfee90... Success: 0x61=’a’ score=9 (second best: 0x05=’?’ score=2)
Reading at malicious_x = 0xffffffffffdfee91... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfee92... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfee93... Success: 0x73=’s’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee94... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfee95... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfee96... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfee97... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfee98... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfee99... Success: 0x69=’i’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9a... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfee9b... Success: 0x72=’r’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9c... Success: 0x61=’a’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9d... Success: 0x67=’g’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9e... Success: 0x65=’e’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9f... Success: 0x2E=’.’ score=2

@cromefire
Copy link

cromefire commented Jan 11, 2018

OS and CPU

4.13.0-25-generic #29-Ubuntu SMP Mon Jan 8 21:14:41 UTC 2018 x86_64
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 94
model name	: Intel(R) Core(TM) i5-6600 CPU @ 3.30GHz
stepping	: 3
microcode	: 0xba
cpu MHz		: 3300.000
cache size	: 6144 KB
physical id	: 0

Ubuntu artful with all updates

Results

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfeea8... Success: 0x54=’T’ score=153 (second best: 0x05=’?’ score=74)
Reading at malicious_x = 0xffffffffffdfeea9... Unclear: 0x68=’h’ score=997 (second best: 0x00=’?’ score=630)
Reading at malicious_x = 0xffffffffffdfeeaa... Unclear: 0x65=’e’ score=997 (second best: 0x05=’?’ score=529)
Reading at malicious_x = 0xffffffffffdfeeab... Unclear: 0x00=’?’ score=497 (second best: 0x05=’?’ score=455)
Reading at malicious_x = 0xffffffffffdfeeac... Success: 0x4D=’M’ score=105 (second best: 0x05=’?’ score=50)
Reading at malicious_x = 0xffffffffffdfeead... Unclear: 0x61=’a’ score=996 (second best: 0x05=’?’ score=565)
Reading at malicious_x = 0xffffffffffdfeeae... Unclear: 0x67=’g’ score=285 (second best: 0x00=’?’ score=143)
Reading at malicious_x = 0xffffffffffdfeeaf... Success: 0x69=’i’ score=757 (second best: 0x6A=’j’ score=376)
Reading at malicious_x = 0xffffffffffdfeeb0... Success: 0x63=’c’ score=133 (second best: 0x05=’?’ score=64)
Reading at malicious_x = 0xffffffffffdfeeb1... Success: 0x05=’?’ score=267 (second best: 0x00=’?’ score=128)
Reading at malicious_x = 0xffffffffffdfeeb2... Unclear: 0x57=’W’ score=998 (second best: 0x00=’?’ score=528)
Reading at malicious_x = 0xffffffffffdfeeb3... Success: 0x6F=’o’ score=69 (second best: 0x05=’?’ score=32)
Reading at malicious_x = 0xffffffffffdfeeb4... Success: 0x72=’r’ score=85 (second best: 0x05=’?’ score=40)
Reading at malicious_x = 0xffffffffffdfeeb5... Unclear: 0x64=’d’ score=995 (second best: 0x00=’?’ score=625)
Reading at malicious_x = 0xffffffffffdfeeb6... Success: 0x73=’s’ score=219 (second best: 0x00=’?’ score=104)
Reading at malicious_x = 0xffffffffffdfeeb7... Unclear: 0x05=’?’ score=526 (second best: 0x00=’?’ score=420)
Reading at malicious_x = 0xffffffffffdfeeb8... Unclear: 0x61=’a’ score=990 (second best: 0x05=’?’ score=545)
Reading at malicious_x = 0xffffffffffdfeeb9... Unclear: 0x72=’r’ score=997 (second best: 0x00=’?’ score=609)
Reading at malicious_x = 0xffffffffffdfeeba... Success: 0x65=’e’ score=753 (second best: 0x00=’?’ score=373)
Reading at malicious_x = 0xffffffffffdfeebb... Success: 0x00=’?’ score=180 (second best: 0x05=’?’ score=89)
Reading at malicious_x = 0xffffffffffdfeebc... Unclear: 0x53=’S’ score=996 (second best: 0x54=’T’ score=620)
Reading at malicious_x = 0xffffffffffdfeebd... Unclear: 0x71=’q’ score=992 (second best: 0x00=’?’ score=610)
Reading at malicious_x = 0xffffffffffdfeebe... Unclear: 0x75=’u’ score=960 (second best: 0x00=’?’ score=513)
Reading at malicious_x = 0xffffffffffdfeebf... Unclear: 0x65=’e’ score=911 (second best: 0x00=’?’ score=519)
Reading at malicious_x = 0xffffffffffdfeec0... Success: 0x61=’a’ score=249 (second best: 0x62=’b’ score=122)
Reading at malicious_x = 0xffffffffffdfeec1... Success: 0x6D=’m’ score=75 (second best: 0x05=’?’ score=35)
Reading at malicious_x = 0xffffffffffdfeec2... Unclear: 0x69=’i’ score=929 (second best: 0x00=’?’ score=591)
Reading at malicious_x = 0xffffffffffdfeec3... Success: 0x73=’s’ score=147 (second best: 0x05=’?’ score=71)
Reading at malicious_x = 0xffffffffffdfeec4... Unclear: 0x68=’h’ score=999 (second best: 0x00=’?’ score=671)
Reading at malicious_x = 0xffffffffffdfeec5... Success: 0x05=’?’ score=35 (second best: 0x00=’?’ score=13)
Reading at malicious_x = 0xffffffffffdfeec6... Success: 0x4F=’O’ score=463 (second best: 0x05=’?’ score=229)
Reading at malicious_x = 0xffffffffffdfeec7... Success: 0x73=’s’ score=97 (second best: 0x05=’?’ score=46)
Reading at malicious_x = 0xffffffffffdfeec8... Success: 0x73=’s’ score=565 (second best: 0x05=’?’ score=280)
Reading at malicious_x = 0xffffffffffdfeec9... Unclear: 0x69=’i’ score=887 (second best: 0x00=’?’ score=490)
Reading at malicious_x = 0xffffffffffdfeeca... Success: 0x66=’f’ score=731 (second best: 0x00=’?’ score=361)
Reading at malicious_x = 0xffffffffffdfeecb... Success: 0x72=’r’ score=55 (second best: 0x05=’?’ score=25)
Reading at malicious_x = 0xffffffffffdfeecc... Success: 0x61=’a’ score=521 (second best: 0x00=’?’ score=256)
Reading at malicious_x = 0xffffffffffdfeecd... Success: 0x67=’g’ score=143 (second best: 0x05=’?’ score=69)
Reading at malicious_x = 0xffffffffffdfeece... Unclear: 0x65=’e’ score=995 (second best: 0x00=’?’ score=533)
Reading at malicious_x = 0xffffffffffdfeecf... Success: 0x2E=’.’ score=721 (second best: 0x05=’?’ score=358)

With lowest threshold:

Using a cache hit threshold of 62.
Build: RDTSCP_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfeea8... Success: 0x05=’?’ score=15 (second best: 0x54=’T’ score=5)
Reading at malicious_x = 0xffffffffffdfeea9... Success: 0x05=’?’ score=2 
Reading at malicious_x = 0xffffffffffdfeeaa... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfeeab... Unclear: 0x05=’?’ score=35 (second best: 0x20=’ ’ score=22)
Reading at malicious_x = 0xffffffffffdfeeac... Unclear: 0x05=’?’ score=44 (second best: 0x4D=’M’ score=38)
Reading at malicious_x = 0xffffffffffdfeead... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfeeae... Success: 0x67=’g’ score=9 (second best: 0x00=’?’ score=2)
Reading at malicious_x = 0xffffffffffdfeeaf... Success: 0x69=’i’ score=7 (second best: 0x6A=’j’ score=1)
Reading at malicious_x = 0xffffffffffdfeeb0... Unclear: 0x63=’c’ score=70 (second best: 0x05=’?’ score=36)
Reading at malicious_x = 0xffffffffffdfeeb1... Success: 0x05=’?’ score=9 (second best: 0x20=’ ’ score=2)
Reading at malicious_x = 0xffffffffffdfeeb2... Success: 0x57=’W’ score=23 (second best: 0x05=’?’ score=9)
Reading at malicious_x = 0xffffffffffdfeeb3... Unclear: 0x6F=’o’ score=54 (second best: 0x05=’?’ score=40)
Reading at malicious_x = 0xffffffffffdfeeb4... Success: 0x05=’?’ score=9 (second best: 0x72=’r’ score=2)
Reading at malicious_x = 0xffffffffffdfeeb5... Success: 0x05=’?’ score=2 
Reading at malicious_x = 0xffffffffffdfeeb6... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfeeb7... Success: 0x05=’?’ score=2 
Reading at malicious_x = 0xffffffffffdfeeb8... Unclear: 0x05=’?’ score=47 (second best: 0x61=’a’ score=43)
Reading at malicious_x = 0xffffffffffdfeeb9... Success: 0x05=’?’ score=27 (second best: 0x00=’?’ score=13)
Reading at malicious_x = 0xffffffffffdfeeba... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfeebb... Success: 0x05=’?’ score=17 (second best: 0x20=’ ’ score=6)
Reading at malicious_x = 0xffffffffffdfeebc... Unclear: 0x53=’S’ score=58 (second best: 0x05=’?’ score=42)
Reading at malicious_x = 0xffffffffffdfeebd... Success: 0x71=’q’ score=9 (second best: 0x05=’?’ score=2)
Reading at malicious_x = 0xffffffffffdfeebe... Success: 0x75=’u’ score=11 (second best: 0x05=’?’ score=3)
Reading at malicious_x = 0xffffffffffdfeebf... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfeec0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfeec1... Unclear: 0x6D=’m’ score=72 (second best: 0x05=’?’ score=46)
Reading at malicious_x = 0xffffffffffdfeec2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfeec3... Success: 0x05=’?’ score=2 
Reading at malicious_x = 0xffffffffffdfeec4... Success: 0x05=’?’ score=7 (second best: 0x00=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeec5... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfeec6... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfeec7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfeec8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfeec9... Success: 0x69=’i’ score=33 (second best: 0x00=’?’ score=14)
Reading at malicious_x = 0xffffffffffdfeeca... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfeecb... Success: 0x05=’?’ score=2 
Reading at malicious_x = 0xffffffffffdfeecc... Success: 0x61=’a’ score=45 (second best: 0x05=’?’ score=20)
Reading at malicious_x = 0xffffffffffdfeecd... Success: 0x67=’g’ score=19 (second best: 0x05=’?’ score=7)
Reading at malicious_x = 0xffffffffffdfeece... Unclear: 0x65=’e’ score=62 (second best: 0x05=’?’ score=40)
Reading at malicious_x = 0xffffffffffdfeecf... Success: 0x05=’?’ score=2

@TheHendla
Copy link

OS and CPU
Linux dosbox 4.14.13-1-ARCH #1 SMP PREEMPT Wed Jan 10 11:14:50 UTC 2018 x86_64 GNU/Linux

processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 94
model name : Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
stepping : 3
microcode : 0xc2
cpu MHz : 800.116
cache size : 6144 KB
physical id : 0
siblings : 8
core id : 0
cpu cores : 4
apicid : 0
initial apicid : 0
fpu : yes
fpu_exception : yes
cpuid level : 22
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts
acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs
bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64
monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt
tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb
invpcid_single pti intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep
bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat
pln pts hwp hwp_notify hwp_act_window hwp_epp
bugs : cpu_meltdown
bogomips : 5186.00
clflush size : 64
cache_alignment : 64
address sizes : 39 bits physical, 48 bits virtual
power management:

Result
Found highest Success Result on cache hit threshold 43:

Using a cache hit threshold of 43. Build: RDTSCP_SUPPORTED CLFLUSH_SUPPORTED Reading 40 bytes: Reading at malicious_x = 0xffffffffffdfee78... Success: 0x54=’T’ score=9 (second best: 0x00=’?’ score=1) Reading at malicious_x = 0xffffffffffdfee79... Success: 0x68=’h’ score=2 Reading at malicious_x = 0xffffffffffdfee7a... Success: 0x65=’e’ score=2 Reading at malicious_x = 0xffffffffffdfee7b... Success: 0x20=’ ’ score=2 Reading at malicious_x = 0xffffffffffdfee7c... Success: 0x4D=’M’ score=2 Reading at malicious_x = 0xffffffffffdfee7d... Success: 0x61=’a’ score=2 Reading at malicious_x = 0xffffffffffdfee7e... Success: 0x67=’g’ score=2 Reading at malicious_x = 0xffffffffffdfee7f... Success: 0x69=’i’ score=2 Reading at malicious_x = 0xffffffffffdfee80... Success: 0x63=’c’ score=2 Reading at malicious_x = 0xffffffffffdfee81... Success: 0x20=’ ’ score=2 Reading at malicious_x = 0xffffffffffdfee82... Success: 0x57=’W’ score=2 Reading at malicious_x = 0xffffffffffdfee83... Success: 0x6F=’o’ score=2 Reading at malicious_x = 0xffffffffffdfee84... Success: 0x72=’r’ score=2 Reading at malicious_x = 0xffffffffffdfee85... Success: 0x64=’d’ score=2 Reading at malicious_x = 0xffffffffffdfee86... Success: 0x73=’s’ score=2 Reading at malicious_x = 0xffffffffffdfee87... Success: 0x20=’ ’ score=2 Reading at malicious_x = 0xffffffffffdfee88... Success: 0x61=’a’ score=2 Reading at malicious_x = 0xffffffffffdfee89... Success: 0x72=’r’ score=2 Reading at malicious_x = 0xffffffffffdfee8a... Success: 0x65=’e’ score=2 Reading at malicious_x = 0xffffffffffdfee8b... Success: 0x20=’ ’ score=131 (second best: 0x05=’?’ score=63) Reading at malicious_x = 0xffffffffffdfee8c... Success: 0x53=’S’ score=2 Reading at malicious_x = 0xffffffffffdfee8d... Success: 0x71=’q’ score=2 Reading at malicious_x = 0xffffffffffdfee8e... Success: 0x75=’u’ score=2 Reading at malicious_x = 0xffffffffffdfee8f... Success: 0x65=’e’ score=2 Reading at malicious_x = 0xffffffffffdfee90... Success: 0x61=’a’ score=2 Reading at malicious_x = 0xffffffffffdfee91... Success: 0x6D=’m’ score=2 Reading at malicious_x = 0xffffffffffdfee92... Success: 0x69=’i’ score=2 Reading at malicious_x = 0xffffffffffdfee93... Success: 0x73=’s’ score=2 Reading at malicious_x = 0xffffffffffdfee94... Success: 0x68=’h’ score=2 Reading at malicious_x = 0xffffffffffdfee95... Success: 0x20=’ ’ score=2 Reading at malicious_x = 0xffffffffffdfee96... Success: 0x4F=’O’ score=2 Reading at malicious_x = 0xffffffffffdfee97... Success: 0x73=’s’ score=2 Reading at malicious_x = 0xffffffffffdfee98... Success: 0x73=’s’ score=2 Reading at malicious_x = 0xffffffffffdfee99... Success: 0x69=’i’ score=59 (second best: 0x6A=’j’ score=27) Reading at malicious_x = 0xffffffffffdfee9a... Success: 0x66=’f’ score=2 Reading at malicious_x = 0xffffffffffdfee9b... Success: 0x72=’r’ score=2 Reading at malicious_x = 0xffffffffffdfee9c... Success: 0x61=’a’ score=2 Reading at malicious_x = 0xffffffffffdfee9d... Success: 0x67=’g’ score=2 Reading at malicious_x = 0xffffffffffdfee9e... Success: 0x65=’e’ score=2 Reading at malicious_x = 0xffffffffffdfee9f... Success: 0x2E=’.’ score=2

@crozone
Copy link
Owner Author

crozone commented Jan 13, 2018

OS

Darwin 16.7.0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 x86_64

CPU

machdep.cpu.brand: 0
machdep.cpu.signature: 67194
machdep.cpu.extfeature_bits: 4832888832
machdep.cpu.feature_bits: 290732854951541759
machdep.cpu.stepping: 10
machdep.cpu.extfamily: 0
machdep.cpu.extmodel: 1
machdep.cpu.model: 23
machdep.cpu.family: 6
machdep.cpu.brand_string: Intel(R) Core(TM)2 Duo CPU     P8600  @ 2.40GHz
machdep.cpu.vendor: GenuineIntel
machdep.cpu.max_ext: 2147483656
machdep.cpu.max_basic: 13

Results

Version: commit a3f5556cee7c06b72a6d9a6f59a4b6da99f06d55
Using a cache hit threshold of 80.
Build: RDTSCP_NOT_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xfffffffffffffe1a... Success: 0x54=’T’ score=6 
Reading at malicious_x = 0xfffffffffffffe1b... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xfffffffffffffe1c... Success: 0x65=’e’ score=5 (second best: 0x00=’?’ score=2)
Reading at malicious_x = 0xfffffffffffffe1d... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xfffffffffffffe1e... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xfffffffffffffe1f... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xfffffffffffffe20... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xfffffffffffffe21... Success: 0x69=’i’ score=6 
Reading at malicious_x = 0xfffffffffffffe22... Success: 0x63=’c’ score=1 
Reading at malicious_x = 0xfffffffffffffe23... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xfffffffffffffe24... Success: 0x57=’W’ score=1 
Reading at malicious_x = 0xfffffffffffffe25... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xfffffffffffffe26... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xfffffffffffffe27... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xfffffffffffffe28... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xfffffffffffffe29... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xfffffffffffffe2a... Success: 0x61=’a’ score=2 (second best: 0x02=’?’ score=1)
Reading at malicious_x = 0xfffffffffffffe2b... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xfffffffffffffe2c... Success: 0x65=’e’ score=6 (second best: 0x01=’?’ score=1)
Reading at malicious_x = 0xfffffffffffffe2d... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xfffffffffffffe2e... Success: 0x53=’S’ score=3 (second best: 0x08=’?’ score=1)
Reading at malicious_x = 0xfffffffffffffe2f... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xfffffffffffffe30... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xfffffffffffffe31... Success: 0x65=’e’ score=3 
Reading at malicious_x = 0xfffffffffffffe32... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xfffffffffffffe33... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xfffffffffffffe34... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xfffffffffffffe35... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xfffffffffffffe36... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xfffffffffffffe37... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xfffffffffffffe38... Success: 0x4F=’O’ score=1 
Reading at malicious_x = 0xfffffffffffffe39... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xfffffffffffffe3a... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xfffffffffffffe3b... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xfffffffffffffe3c... Unclear: 0x66=’f’ score=3 (second best: 0x00=’?’ score=3)
Reading at malicious_x = 0xfffffffffffffe3d... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xfffffffffffffe3e... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xfffffffffffffe3f... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xfffffffffffffe40... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xfffffffffffffe41... Unclear: 0x2E=’.’ score=1 (second best: 0x02=’?’ score=1)

@jasonwee
Copy link

OS

Linux 4.14.0-2-amd64 #1 SMP Debian 4.14.7-1 (2017-12-22) x86_64 GNU/Linux

CPU

processor	: 7
vendor_id	: GenuineIntel
cpu family	: 6
model		: 94
model name	: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
stepping	: 3
microcode	: 0xc2
cpu MHz		: 2600.000
cache size	: 6144 KB

Results (default THRESHOLD)

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfedb8... Success: 0x54=’T’ score=87 (second best: 0x05=’?’ score=41)
Reading at malicious_x = 0xffffffffffdfedb9... Success: 0x68=’h’ score=125 (second best: 0x00=’?’ score=56)
Reading at malicious_x = 0xffffffffffdfedba... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfedbb... Unclear: 0x20=’ ’ score=153 (second best: 0x00=’?’ score=78)
Reading at malicious_x = 0xffffffffffdfedbc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfedbd... Success: 0x61=’a’ score=81 (second best: 0x00=’?’ score=34)
Reading at malicious_x = 0xffffffffffdfedbe... Success: 0x67=’g’ score=63 (second best: 0x05=’?’ score=29)
Reading at malicious_x = 0xffffffffffdfedbf... Unclear: 0x69=’i’ score=583 (second best: 0x00=’?’ score=293)
Reading at malicious_x = 0xffffffffffdfedc0... Success: 0x63=’c’ score=445 (second best: 0x00=’?’ score=216)
Reading at malicious_x = 0xffffffffffdfedc1... Success: 0x20=’ ’ score=17 (second best: 0x05=’?’ score=6)
Reading at malicious_x = 0xffffffffffdfedc2... Success: 0x57=’W’ score=131 (second best: 0x00=’?’ score=59)
Reading at malicious_x = 0xffffffffffdfedc3... Unclear: 0x6F=’o’ score=750 (second best: 0x00=’?’ score=465)
Reading at malicious_x = 0xffffffffffdfedc4... Success: 0x72=’r’ score=93 (second best: 0x05=’?’ score=44)
Reading at malicious_x = 0xffffffffffdfedc5... Unclear: 0x64=’d’ score=103 (second best: 0x00=’?’ score=53)
Reading at malicious_x = 0xffffffffffdfedc6... Success: 0x73=’s’ score=911 (second best: 0x00=’?’ score=449)
Reading at malicious_x = 0xffffffffffdfedc7... Success: 0x20=’ ’ score=77 (second best: 0x05=’?’ score=36)
Reading at malicious_x = 0xffffffffffdfedc8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfedc9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfedca... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfedcb... Success: 0x20=’ ’ score=207 (second best: 0x00=’?’ score=97)
Reading at malicious_x = 0xffffffffffdfedcc... Unclear: 0x53=’S’ score=957 (second best: 0x54=’T’ score=594)
Reading at malicious_x = 0xffffffffffdfedcd... Success: 0x05=’?’ score=13 
Reading at malicious_x = 0xffffffffffdfedce... Success: 0x75=’u’ score=51 (second best: 0x05=’?’ score=23)
Reading at malicious_x = 0xffffffffffdfedcf... Unclear: 0x65=’e’ score=473 (second best: 0x00=’?’ score=238)
Reading at malicious_x = 0xffffffffffdfedd0... Success: 0x61=’a’ score=51 (second best: 0x05=’?’ score=23)
Reading at malicious_x = 0xffffffffffdfedd1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfedd2... Unclear: 0x69=’i’ score=9 (second best: 0x00=’?’ score=6)
Reading at malicious_x = 0xffffffffffdfedd3... Success: 0x73=’s’ score=31 (second best: 0x05=’?’ score=13)
Reading at malicious_x = 0xffffffffffdfedd4... Success: 0x68=’h’ score=25 (second best: 0x05=’?’ score=10)
Reading at malicious_x = 0xffffffffffdfedd5... Unclear: 0x20=’ ’ score=959 (second best: 0x00=’?’ score=601)
Reading at malicious_x = 0xffffffffffdfedd6... Success: 0x4F=’O’ score=355 (second best: 0x00=’?’ score=171)
Reading at malicious_x = 0xffffffffffdfedd7... Success: 0x73=’s’ score=153 (second best: 0x05=’?’ score=74)
Reading at malicious_x = 0xffffffffffdfedd8... Unclear: 0x73=’s’ score=966 (second best: 0x00=’?’ score=510)
Reading at malicious_x = 0xffffffffffdfedd9... Unclear: 0x69=’i’ score=11 (second best: 0x00=’?’ score=7)
Reading at malicious_x = 0xffffffffffdfedda... Success: 0x66=’f’ score=289 (second best: 0x05=’?’ score=142)
Reading at malicious_x = 0xffffffffffdfeddb... Success: 0x72=’r’ score=429 (second best: 0x00=’?’ score=212)
Reading at malicious_x = 0xffffffffffdfeddc... Success: 0x61=’a’ score=83 (second best: 0x00=’?’ score=39)
Reading at malicious_x = 0xffffffffffdfeddd... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfedde... Success: 0x65=’e’ score=7 (second best: 0x00=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeddf... Success: 0x2E=’.’ score=129 (second best: 0x00=’?’ score=62)

@Nerdmind
Copy link

OS

Linux [hostname] 4.4.0-109-generic #132-Ubuntu SMP Tue Jan 9 19:52:39 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

CPU

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 16
model		: 4
model name	: AMD Phenom(tm) II X4 925 Processor
stepping	: 3
microcode	: 0x10000c8
cpu MHz		: 800.000
cache size	: 512 KB

Results

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfec68... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfec69... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfec6a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec6b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec6c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfec6d... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec6e... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfec6f... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec70... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfec71... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec72... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfec73... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfec74... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec75... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfec76... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec77... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec78... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec79... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec7a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec7b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec7c... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfec7d... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfec7e... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfec7f... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec80... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec81... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfec82... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec83... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec84... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfec85... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec86... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfec87... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec88... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec89... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec8a... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfec8b... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec8c... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec8d... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfec8e... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec8f... Success: 0x2E=’.’ score=2

@Nerdmind
Copy link

OS

Linux [hostname] 4.13.0-26-generic #29~16.04.2-Ubuntu SMP Tue Jan 9 22:00:44 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

CPU

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 142
model name	: Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz
stepping	: 9
microcode	: 0x80
cpu MHz		: 2700.000
cache size	: 3072 KB

Results

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfec68... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfec69... Success: 0x68=’h’ score=9 
Reading at malicious_x = 0xffffffffffdfec6a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec6b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec6c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfec6d... Unclear: 0x61=’a’ score=982 (second best: 0x01=’?’ score=830)
Reading at malicious_x = 0xffffffffffdfec6e... Unclear: 0x67=’g’ score=999 (second best: 0x01=’?’ score=857)
Reading at malicious_x = 0xffffffffffdfec6f... Unclear: 0x69=’i’ score=997 (second best: 0x01=’?’ score=877)
Reading at malicious_x = 0xffffffffffdfec70... Unclear: 0x63=’c’ score=996 (second best: 0x01=’?’ score=885)
Reading at malicious_x = 0xffffffffffdfec71... Unclear: 0x20=’ ’ score=992 (second best: 0x01=’?’ score=834)
Reading at malicious_x = 0xffffffffffdfec72... Unclear: 0x57=’W’ score=999 (second best: 0x01=’?’ score=849)
Reading at malicious_x = 0xffffffffffdfec73... Unclear: 0x6F=’o’ score=994 (second best: 0x01=’?’ score=896)
Reading at malicious_x = 0xffffffffffdfec74... Unclear: 0x72=’r’ score=999 (second best: 0x01=’?’ score=859)
Reading at malicious_x = 0xffffffffffdfec75... Unclear: 0x64=’d’ score=999 (second best: 0x01=’?’ score=826)
Reading at malicious_x = 0xffffffffffdfec76... Unclear: 0x73=’s’ score=999 (second best: 0x01=’?’ score=886)
Reading at malicious_x = 0xffffffffffdfec77... Unclear: 0x20=’ ’ score=998 (second best: 0x01=’?’ score=880)
Reading at malicious_x = 0xffffffffffdfec78... Unclear: 0x61=’a’ score=996 (second best: 0x01=’?’ score=879)
Reading at malicious_x = 0xffffffffffdfec79... Unclear: 0x72=’r’ score=998 (second best: 0x01=’?’ score=866)
Reading at malicious_x = 0xffffffffffdfec7a... Unclear: 0x65=’e’ score=989 (second best: 0x01=’?’ score=804)
Reading at malicious_x = 0xffffffffffdfec7b... Unclear: 0x20=’ ’ score=999 (second best: 0x01=’?’ score=873)
Reading at malicious_x = 0xffffffffffdfec7c... Unclear: 0x53=’S’ score=999 (second best: 0x01=’?’ score=875)
Reading at malicious_x = 0xffffffffffdfec7d... Unclear: 0x71=’q’ score=996 (second best: 0x01=’?’ score=842)
Reading at malicious_x = 0xffffffffffdfec7e... Unclear: 0x75=’u’ score=998 (second best: 0x01=’?’ score=863)
Reading at malicious_x = 0xffffffffffdfec7f... Unclear: 0x65=’e’ score=992 (second best: 0x01=’?’ score=882)
Reading at malicious_x = 0xffffffffffdfec80... Unclear: 0x61=’a’ score=999 (second best: 0x01=’?’ score=860)
Reading at malicious_x = 0xffffffffffdfec81... Unclear: 0x6D=’m’ score=998 (second best: 0x01=’?’ score=869)
Reading at malicious_x = 0xffffffffffdfec82... Unclear: 0x69=’i’ score=999 (second best: 0x01=’?’ score=890)
Reading at malicious_x = 0xffffffffffdfec83... Unclear: 0x73=’s’ score=999 (second best: 0x01=’?’ score=850)
Reading at malicious_x = 0xffffffffffdfec84... Unclear: 0x68=’h’ score=999 (second best: 0x01=’?’ score=866)
Reading at malicious_x = 0xffffffffffdfec85... Unclear: 0x20=’ ’ score=998 (second best: 0x01=’?’ score=807)
Reading at malicious_x = 0xffffffffffdfec86... Unclear: 0x4F=’O’ score=999 (second best: 0x00=’?’ score=904)
Reading at malicious_x = 0xffffffffffdfec87... Unclear: 0x73=’s’ score=999 (second best: 0x00=’?’ score=894)
Reading at malicious_x = 0xffffffffffdfec88... Unclear: 0x73=’s’ score=998 (second best: 0x01=’?’ score=896)
Reading at malicious_x = 0xffffffffffdfec89... Unclear: 0x69=’i’ score=999 (second best: 0x01=’?’ score=843)
Reading at malicious_x = 0xffffffffffdfec8a... Unclear: 0x66=’f’ score=998 (second best: 0x01=’?’ score=888)
Reading at malicious_x = 0xffffffffffdfec8b... Unclear: 0x72=’r’ score=999 (second best: 0x00=’?’ score=911)
Reading at malicious_x = 0xffffffffffdfec8c... Unclear: 0x61=’a’ score=998 (second best: 0x01=’?’ score=829)
Reading at malicious_x = 0xffffffffffdfec8d... Unclear: 0x67=’g’ score=998 (second best: 0x01=’?’ score=847)
Reading at malicious_x = 0xffffffffffdfec8e... Unclear: 0x65=’e’ score=993 (second best: 0x01=’?’ score=857)
Reading at malicious_x = 0xffffffffffdfec8f... Unclear: 0x2E=’.’ score=997 (second best: 0x01=’?’ score=902)

@DennisSc
Copy link

DennisSc commented Jan 17, 2018

OS: Windows 10 Enterprise 1709 x64 (build 10.0.16299)

CPU: Intel(R) Core(TM) i5-2500T @ 2,3 GHz (SandyBridge)

compiled with VS2017, I get the following output:

C:\Users\Dennis\Documents\Visual Studio 2017\Projects\SpectrePoC\x64\Debug>.\SpectrePoC.exe
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = FFFFFFFFFFFFDBA0... Success: 0x54=ÆTÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA1... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA2... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA3... Success: 0x20=Æ Æ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA4... Success: 0x4D=ÆMÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA5... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA6... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA7... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA8... Success: 0x63=ÆcÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBA9... Success: 0x20=Æ Æ score=2
Reading at malicious_x = FFFFFFFFFFFFDBAA... Success: 0x57=ÆWÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBAB... Success: 0x6F=ÆoÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBAC... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBAD... Success: 0x64=ÆdÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBAE... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBAF... Success: 0x20=Æ Æ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB0... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB1... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB2... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB3... Success: 0x20=Æ Æ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB4... Success: 0x53=ÆSÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB5... Success: 0x71=ÆqÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB6... Success: 0x75=ÆuÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB7... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB8... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBB9... Success: 0x6D=ÆmÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBBA... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBBB... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBBC... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBBD... Success: 0x20=Æ Æ score=2
Reading at malicious_x = FFFFFFFFFFFFDBBE... Success: 0x4F=ÆOÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBBF... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBC0... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBC1... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBC2... Success: 0x66=ÆfÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBC3... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBC4... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBC5... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBC6... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = FFFFFFFFFFFFDBC7... Success: 0x2E=Æ.Æ score=2

C:\Users\Dennis\Documents\Visual Studio 2017\Projects\SpectrePoC\x64\Debug>

Scared now, since Intel(R) offers no BIOS updates for my Intel(R) DesktopBoard(TM) any more, it is EOL since a few days - coincidentally. :/

edit - well, i even get 100% success rate on a fully patched system (which should not be vulnerable according to the powershell module offered by microsoft) with this PoC, so either this PoC doesn't produce meaningful results, or the MS test is wrong and/or their patches don't help against Spectre. Interesting side note: the PoC EXE is recognized by Windows Defender as "exploit:spectre.a".

@schloegl
Copy link

schloegl commented Jan 20, 2018

$ uname -a
Linux 4.9.0-5-amd64 #1 SMP Debian 4.9.65-3+deb9u2 (2018-01-04) x86_64 GNU/Linux
$ cat /proc/cpuinfo

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 23
model name	: Pentium(R) Dual-Core  CPU      E5200  @ 2.50GHz
stepping	: 6
microcode	: 0x60f
cpu MHz		: 1200.000
cache size	: 2048 KB
physical id	: 0
siblings	: 2
core id		: 0
cpu cores	: 2
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 10
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good nopl aperfmperf eagerfpu pni dtes64 monitor ds_cpl est tm2 ssse3 cx16 xtpr pdcm lahf_lm kaiser dtherm
bugs		:
bogomips	: 5020.74
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

processor	: 1
vendor_id	: GenuineIntel
cpu family	: 6
model		: 23
model name	: Pentium(R) Dual-Core  CPU      E5200  @ 2.50GHz
stepping	: 6
microcode	: 0x60f
cpu MHz		: 1200.000
cache size	: 2048 KB
physical id	: 0
siblings	: 2
core id		: 1
cpu cores	: 2
apicid		: 1
initial apicid	: 1
fpu		: yes
fpu_exception	: yes
cpuid level	: 10
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good nopl aperfmperf eagerfpu pni dtes64 monitor ds_cpl est tm2 ssse3 cx16 xtpr pdcm lahf_lm kaiser dtherm
bugs		:
bogomips	: 5020.74
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

$ make -B; ./spectre.out

cc -std=c99 -DGIT_COMMIT_HASH='"f495c2bb929e2d05449be17b8fa678ee73f231e7"' -o spectre.out spectre.c
Version: commit f495c2bb929e2d05449be17b8fa678ee73f231e7
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Ungültiger Maschinenbefehl

$ CFLAGS=-DNORDTSCP make -B; ./spectre.out

cc -DNORDTSCP -std=c99 -DGIT_COMMIT_HASH='"f495c2bb929e2d05449be17b8fa678ee73f231e7"' -o spectre.out spectre.c
Version: commit f495c2bb929e2d05449be17b8fa678ee73f231e7
Using a cache hit threshold of 80.
Build: RDTSCP_NOT_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee58... Unclear: 0x0E=’?’ score=13 (second best: 0x03=’?’ score=13)
Reading at malicious_x = 0xffffffffffdfee59... Unclear: 0x0E=’?’ score=9 (second best: 0x03=’?’ score=9)
Reading at malicious_x = 0xffffffffffdfee5a... Unclear: 0x0E=’?’ score=10 (second best: 0x03=’?’ score=10)
Reading at malicious_x = 0xffffffffffdfee5b... Unclear: 0x0E=’?’ score=19 (second best: 0x02=’?’ score=19)
Reading at malicious_x = 0xffffffffffdfee5c... Unclear: 0x0E=’?’ score=9 (second best: 0x03=’?’ score=9)
Reading at malicious_x = 0xffffffffffdfee5d... Unclear: 0x02=’?’ score=24 (second best: 0x0E=’?’ score=23)
Reading at malicious_x = 0xffffffffffdfee5e... Unclear: 0x0E=’?’ score=8 (second best: 0x03=’?’ score=8)
Reading at malicious_x = 0xffffffffffdfee5f... Unclear: 0x02=’?’ score=27 (second best: 0x0E=’?’ score=26)
Reading at malicious_x = 0xffffffffffdfee60... Unclear: 0x02=’?’ score=22 (second best: 0x0E=’?’ score=21)
Reading at malicious_x = 0xffffffffffdfee61... Unclear: 0x0E=’?’ score=34 (second best: 0x02=’?’ score=33)
Reading at malicious_x = 0xffffffffffdfee62... Unclear: 0x03=’?’ score=33 (second best: 0x02=’?’ score=32)
Reading at malicious_x = 0xffffffffffdfee63... Unclear: 0x02=’?’ score=20 (second best: 0x03=’?’ score=19)
Reading at malicious_x = 0xffffffffffdfee64... Unclear: 0x02=’?’ score=44 (second best: 0x0E=’?’ score=43)
Reading at malicious_x = 0xffffffffffdfee65... Unclear: 0x03=’?’ score=41 (second best: 0x02=’?’ score=40)
Reading at malicious_x = 0xffffffffffdfee66... Unclear: 0x03=’?’ score=14 (second best: 0x0E=’?’ score=13)
Reading at malicious_x = 0xffffffffffdfee67... Unclear: 0x0E=’?’ score=16 (second best: 0x09=’?’ score=16)
Reading at malicious_x = 0xffffffffffdfee68... Unclear: 0x03=’?’ score=21 (second best: 0x0E=’?’ score=20)
Reading at malicious_x = 0xffffffffffdfee69... Unclear: 0x0E=’?’ score=42 (second best: 0x03=’?’ score=40)
Reading at malicious_x = 0xffffffffffdfee6a... Unclear: 0x0E=’?’ score=24 (second best: 0x03=’?’ score=24)
Reading at malicious_x = 0xffffffffffdfee6b... Unclear: 0x0E=’?’ score=16 (second best: 0x02=’?’ score=16)
Reading at malicious_x = 0xffffffffffdfee6c... Unclear: 0x0E=’?’ score=9 (second best: 0x03=’?’ score=9)
Reading at malicious_x = 0xffffffffffdfee6d... Unclear: 0x0E=’?’ score=13 (second best: 0x03=’?’ score=12)
Reading at malicious_x = 0xffffffffffdfee6e... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfee6f... Unclear: 0x02=’?’ score=11 (second best: 0x0E=’?’ score=9)
Reading at malicious_x = 0xffffffffffdfee70... Unclear: 0x0E=’?’ score=22 (second best: 0x03=’?’ score=20)
Reading at malicious_x = 0xffffffffffdfee71... Unclear: 0x0E=’?’ score=10 (second best: 0x02=’?’ score=9)
Reading at malicious_x = 0xffffffffffdfee72... Unclear: 0x03=’?’ score=11 (second best: 0x0E=’?’ score=10)
Reading at malicious_x = 0xffffffffffdfee73... Unclear: 0x0E=’?’ score=14 (second best: 0x03=’?’ score=14)
Reading at malicious_x = 0xffffffffffdfee74... Success: 0xFF=’?’ score=0 

$ ./spectre.out 400

Version: commit f495c2bb929e2d05449be17b8fa678ee73f231e7
Using a cache hit threshold of 400.
Build: RDTSCP_NOT_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee58... Unclear: 0xB4=’?’ score=826 (second best: 0x82=’?’ score=825)
Reading at malicious_x = 0xffffffffffdfee59... Unclear: 0x00=’?’ score=515 (second best: 0xFC=’?’ score=499)
Reading at malicious_x = 0xffffffffffdfee5a... Unclear: 0x00=’?’ score=695 (second best: 0x3B=’;’ score=676)
Reading at malicious_x = 0xffffffffffdfee5b... Unclear: 0x00=’?’ score=797 (second best: 0x4E=’N’ score=792)
Reading at malicious_x = 0xffffffffffdfee5c... Unclear: 0x00=’?’ score=470 (second best: 0x01=’?’ score=464)
Reading at malicious_x = 0xffffffffffdfee5d... Unclear: 0x00=’?’ score=655 (second best: 0xC8=’?’ score=652)
Reading at malicious_x = 0xffffffffffdfee5e... Unclear: 0x00=’?’ score=552 (second best: 0xD9=’?’ score=545)
Reading at malicious_x = 0xffffffffffdfee5f... Unclear: 0x00=’?’ score=561 (second best: 0xFD=’?’ score=551)
Reading at malicious_x = 0xffffffffffdfee60... Unclear: 0x00=’?’ score=739 (second best: 0x3C=’<’ score=723)
Reading at malicious_x = 0xffffffffffdfee61... Unclear: 0x00=’?’ score=758 (second best: 0xED=’?’ score=758)
Reading at malicious_x = 0xffffffffffdfee62... Unclear: 0x00=’?’ score=783 (second best: 0x33=’3’ score=780)
Reading at malicious_x = 0xffffffffffdfee63... Unclear: 0x00=’?’ score=409 (second best: 0x01=’?’ score=398)
Reading at malicious_x = 0xffffffffffdfee64... Unclear: 0xA7=’?’ score=745 (second best: 0xF9=’?’ score=744)
Reading at malicious_x = 0xffffffffffdfee65... Unclear: 0x00=’?’ score=625 (second best: 0x9F=’?’ score=611)
Reading at malicious_x = 0xffffffffffdfee66... Unclear: 0x00=’?’ score=625 (second best: 0x51=’Q’ score=615)
Reading at malicious_x = 0xffffffffffdfee67... Unclear: 0x00=’?’ score=689 (second best: 0xE9=’?’ score=666)
Reading at malicious_x = 0xffffffffffdfee68... Unclear: 0xF8=’?’ score=681 (second best: 0xFD=’?’ score=667)
Reading at malicious_x = 0xffffffffffdfee69... Unclear: 0x00=’?’ score=555 (second best: 0xFC=’?’ score=552)
Reading at malicious_x = 0xffffffffffdfee6a... Unclear: 0x00=’?’ score=445 (second best: 0x0B=’?’ score=422)
Reading at malicious_x = 0xffffffffffdfee6b... Unclear: 0x00=’?’ score=514 (second best: 0x08=’?’ score=514)
Reading at malicious_x = 0xffffffffffdfee6c... Unclear: 0x9E=’?’ score=762 (second best: 0x5B=’[’ score=760)
Reading at malicious_x = 0xffffffffffdfee6d... Unclear: 0x00=’?’ score=881 (second best: 0xEB=’?’ score=867)
Reading at malicious_x = 0xffffffffffdfee6e... Unclear: 0x00=’?’ score=692 (second best: 0xA1=’?’ score=686)
Reading at malicious_x = 0xffffffffffdfee6f... Unclear: 0xAA=’?’ score=630 (second best: 0xDC=’?’ score=623)
Reading at malicious_x = 0xffffffffffdfee70... Unclear: 0x4B=’K’ score=881 (second best: 0xA9=’?’ score=875)
Reading at malicious_x = 0xffffffffffdfee71... Unclear: 0x00=’?’ score=910 (second best: 0xA9=’?’ score=896)
Reading at malicious_x = 0xffffffffffdfee72... Unclear: 0x00=’?’ score=413 (second best: 0x02=’?’ score=400)
Reading at malicious_x = 0xffffffffffdfee73... Unclear: 0x00=’?’ score=705 (second best: 0x95=’?’ score=697)
Reading at malicious_x = 0xffffffffffdfee74... Unclear: 0xFD=’?’ score=794 (second best: 0x00=’?’ score=789)
Reading at malicious_x = 0xffffffffffdfee75... Unclear: 0x3C=’<’ score=891 (second best: 0xA9=’?’ score=889)
Reading at malicious_x = 0xffffffffffdfee76... Unclear: 0x00=’?’ score=692 (second best: 0xFB=’?’ score=687)
Reading at malicious_x = 0xffffffffffdfee77... Unclear: 0x6F=’o’ score=875 (second best: 0x00=’?’ score=862)
Reading at malicious_x = 0xffffffffffdfee78... Unclear: 0x00=’?’ score=887 (second best: 0x61=’a’ score=879)
Reading at malicious_x = 0xffffffffffdfee79... Unclear: 0xF8=’?’ score=735 (second best: 0xFD=’?’ score=722)
Reading at malicious_x = 0xffffffffffdfee7a... Unclear: 0x00=’?’ score=729 (second best: 0x94=’?’ score=705)
Reading at malicious_x = 0xffffffffffdfee7b... Unclear: 0x25=’%’ score=782 (second best: 0xA2=’?’ score=781)
Reading at malicious_x = 0xffffffffffdfee7c... Unclear: 0x00=’?’ score=625 (second best: 0xC9=’?’ score=607)
Reading at malicious_x = 0xffffffffffdfee7d... Unclear: 0xA3=’?’ score=892 (second best: 0x00=’?’ score=889)
Reading at malicious_x = 0xffffffffffdfee7e... Unclear: 0x00=’?’ score=735 (second best: 0x81=’?’ score=732)
Reading at malicious_x = 0xffffffffffdfee7f... Unclear: 0xF8=’?’ score=662 (second best: 0xF9=’?’ score=661)
nclear: 0x0E=’?’ score=17 (second best: 0x03=’?’ score=17)
Reading at malicious_x = 0xffffffffffdfee76... Unclear: 0x0E=’?’ score=24 (second best: 0x03=’?’ score=24)
Reading at malicious_x = 0xffffffffffdfee77... Unclear: 0x02=’?’ score=20 (second best: 0x0E=’?’ score=19)
Reading at malicious_x = 0xffffffffffdfee78... Unclear: 0x0E=’?’ score=8 (second best: 0x02=’?’ score=8)
Reading at malicious_x = 0xffffffffffdfee79... Unclear: 0x02=’?’ score=13 (second best: 0x0E=’?’ score=12)
Reading at malicious_x = 0xffffffffffdfee7a... Unclear: 0x0E=’?’ score=10 (second best: 0x02=’?’ score=10)
Reading at malicious_x = 0xffffffffffdfee7b... Unclear: 0x02=’?’ score=19 (second best: 0x03=’?’ score=18)
Reading at malicious_x = 0xffffffffffdfee7c... Unclear: 0x02=’?’ score=19 (second best: 0x0E=’?’ score=18)
Reading at malicious_x = 0xffffffffffdfee7d... Unclear: 0x03=’?’ score=9 (second best: 0x0E=’?’ score=8)
Reading at malicious_x = 0xffffffffffdfee7e... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfee7f... Unclear: 0x0E=’?’ score=12 (second best: 0x03=’?’ score=12)


It seems the the attack does not work on Pentium Dual Core E5200. This is in agreement with

https://www.intel.com/content/www/us/en/architecture-and-technology/facts-about-side-channel-analysis-and-intel-products.html#4
https://www.techarp.com/articles/intel-amd-arm-cpu-bug-4/

@schloegl
Copy link

OS

Linux popper 4.14.0-0.bpo.3-amd64 #1 SMP Debian 4.14.13-1~bpo9+1 (2018-01-14) x86_64 GNU/Linux

CPU

$ lscpu

CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                4
On-line CPU(s) list:   0-3
Thread(s) per core:    1
Core(s) per socket:    4
Socket(s):             1
NUMA node(s):          1
Vendor ID:             AuthenticAMD
CPU family:            16
Model:                 4
Model name:            AMD Phenom(tm) II X4 965 Processor
Stepping:              3
CPU MHz:               800.000
CPU max MHz:           3400,0000
CPU min MHz:           800,0000
BogoMIPS:              6830.48
Virtualization:        AMD-V
L1d cache:             64K
L1i cache:             64K
L2 cache:              512K
L3 cache:              6144K
NUMA node0 CPU(s):     0-3
Flags:                 fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm 3dnowext 3dnow constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid pni monitor cx16 popcnt lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt hw_pstate vmmcall npt lbrv svm_lock nrip_save

Results

CACHE_HIT_THRESHOLD = 80

$ ./spectre.out

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee18... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee19... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1f... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee20... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee21... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee22... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee23... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee24... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee25... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee26... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee27... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee28... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee29... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2f... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee30... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee31... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee32... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee33... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee34... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee35... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee36... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee37... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee38... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee39... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3f... Success: 0xFF='?' score=0 

CACHE_HIT_THRESHOLD = 300

$ ./spectre.out 300

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee18... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee19... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1f... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee20... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee21... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee22... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee23... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee24... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee25... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee26... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee27... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee28... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee29... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2f... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee30... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee31... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee32... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee33... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee34... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee35... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee36... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee37... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee38... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee39... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3f... Success: 0xFF='?' score=0 

CACHE_HIT_THRESHOLD = 1200

$ ./spectre.out 1200

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee18... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee19... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee1f... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee20... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee21... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee22... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee23... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee24... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee25... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee26... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee27... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee28... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee29... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee2f... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee30... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee31... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee32... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee33... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee34... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee35... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee36... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee37... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee38... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee39... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3a... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3b... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3c... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3d... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3e... Success: 0xFF='?' score=0 
Reading at malicious_x = 0xffffffffffdfee3f... Success: 0xFF='?' score=0 

These results suggest that the AMD Phenom(tm) II X4 965 is not vulnerable.

@akidee
Copy link

akidee commented Jan 24, 2018

#12

@NeCarbon
Copy link

NeCarbon commented Feb 5, 2018

OS:

Linux 4.15.0-041500-generic #201801282230 SMP Sun Jan 28 22:31:30 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

CPU:


processor       : 0
vendor_id       : AuthenticAMD
cpu family      : 16
model           : 6
model name      : AMD Athlon(tm) II X2 250 Processor
stepping        : 3
microcode       : 0x10000c8
cpu MHz         : 3000.509
cache size      : 1024 KB
physical id     : 0
siblings        : 2
core id         : 0
cpu cores       : 2
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 5
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm 3dnowext 3dnow constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid pni monitor cx16 popcnt lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt hw_pstate retpoline retpoline_amd rsb_ctxsw vmmcall npt lbrv svm_lock nrip_save
bugs            : tlb_mmatch fxsave_leak sysret_ss_attrs null_seg spectre_v1 spectre_v2
bogomips        : 6001.01
TLB size        : 1024 4K pages
clflush size    : 64
cache_alignment : 64
address sizes   : 48 bits physical, 48 bits virtual
power management: ts ttp tm stc 100mhzsteps hwpstate

Results:

./spectre

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfef18... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfef19... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfef1a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfef1b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfef1c... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfef1d... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfef1e... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfef1f... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfef20... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfef21... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfef22... Success: 0x57=’W’ score=1
Reading at malicious_x = 0xffffffffffdfef23... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfef24... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfef25... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfef26... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfef27... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfef28... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfef29... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfef2a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfef2b... Success: 0x20=’ ’ score=1
Reading at malicious_x = 0xffffffffffdfef2c... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfef2d... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfef2e... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfef2f... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfef30... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfef31... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfef32... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfef33... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfef34... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfef35... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfef36... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfef37... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfef38... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfef39... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfef3a... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfef3b... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfef3c... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfef3d... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfef3e... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfef3f... Success: 0x2E=’.’ score=2

./spectre 300

Using a cache hit threshold of 300.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfef18... Unclear: 0xE1=’?’ score=999 (second best: 0x94=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef19... Unclear: 0xE1=’?’ score=999 (second best: 0x9F=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef1a... Unclear: 0xEF=’?’ score=999 (second best: 0xC4=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef1b... Unclear: 0xE1=’?’ score=999 (second best: 0x89=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef1c... Unclear: 0xB4=’?’ score=999 (second best: 0x88=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef1d... Unclear: 0xEF=’?’ score=999 (second best: 0xC1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef1e... Unclear: 0xEC=’?’ score=999 (second best: 0xE1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef1f... Unclear: 0xB4=’?’ score=999 (second best: 0x9F=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef20... Unclear: 0xEC=’?’ score=999 (second best: 0xE1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef21... Unclear: 0x72=’r’ score=999 (second best: 0x50=’P’ score=999)
Reading at malicious_x = 0xffffffffffdfef22... Unclear: 0xAA=’?’ score=999 (second best: 0x57=’W’ score=999)
Reading at malicious_x = 0xffffffffffdfef23... Unclear: 0xC7=’?’ score=999 (second best: 0xB4=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef24... Unclear: 0xB4=’?’ score=999 (second best: 0x88=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef25... Unclear: 0xE1=’?’ score=999 (second best: 0x89=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef26... Unclear: 0xB4=’?’ score=999 (second best: 0x9F=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef27... Unclear: 0x8B=’?’ score=999 (second best: 0x20=’ ’ score=999)
Reading at malicious_x = 0xffffffffffdfef28... Unclear: 0xEF=’?’ score=999 (second best: 0xE1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef29... Unclear: 0x72=’r’ score=999 (second best: 0x39=’9’ score=999)
Reading at malicious_x = 0xffffffffffdfef2a... Unclear: 0xE1=’?’ score=999 (second best: 0xC1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef2b... Unclear: 0xB4=’?’ score=999 (second best: 0x94=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef2c... Unclear: 0xE1=’?’ score=999 (second best: 0xC1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef2d... Unclear: 0xEF=’?’ score=999 (second best: 0xEC=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef2e... Unclear: 0xEC=’?’ score=999 (second best: 0xE1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef2f... Unclear: 0xEC=’?’ score=999 (second best: 0xB4=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef30... Unclear: 0x88=’?’ score=999 (second best: 0x61=’a’ score=999)
Reading at malicious_x = 0xffffffffffdfef31... Unclear: 0xE1=’?’ score=999 (second best: 0x9F=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef32... Unclear: 0xEE=’?’ score=999 (second best: 0xC1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef33... Unclear: 0xEC=’?’ score=999 (second best: 0xE1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef34... Unclear: 0xB4=’?’ score=999 (second best: 0x68=’h’ score=999)
Reading at malicious_x = 0xffffffffffdfef35... Unclear: 0xEF=’?’ score=999 (second best: 0xB4=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef36... Unclear: 0xEF=’?’ score=999 (second best: 0xEC=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef37... Unclear: 0xB4=’?’ score=999 (second best: 0x94=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef38... Unclear: 0x89=’?’ score=999 (second best: 0x73=’s’ score=999)
Reading at malicious_x = 0xffffffffffdfef39... Unclear: 0xE1=’?’ score=999 (second best: 0xB4=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef3a... Unclear: 0xEE=’?’ score=999 (second best: 0xB4=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef3b... Unclear: 0xB4=’?’ score=999 (second best: 0x88=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef3c... Unclear: 0x74=’t’ score=999 (second best: 0x72=’r’ score=999)
Reading at malicious_x = 0xffffffffffdfef3d... Unclear: 0xB4=’?’ score=999 (second best: 0x9F=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef3e... Unclear: 0xE1=’?’ score=999 (second best: 0xC1=’?’ score=999)
Reading at malicious_x = 0xffffffffffdfef3f... Unclear: 0x91=’?’ score=999 (second best: 0x89=’?’ score=999)

@Postrediori
Copy link
Contributor

OS

Fedora 27

Linux 4.14.16-300.fc27.x86_64 #1 SMP Wed Jan 31 19:24:27 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

CPU

$ head /proc/cpuinfo
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 42
model name	: Intel(R) Core(TM) i3-2370M CPU @ 2.40GHz
stepping	: 7
microcode	: 0x29
cpu MHz		: 1387.150
cache size	: 3072 KB
physical id	: 0

Results

CACHE_HIT_THRESHOLD = 80

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfeb70... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfeb71... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfeb72... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfeb73... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfeb74... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfeb75... Success: 0x61=’a’ score=13 (second best: 0x05=’?’ score=4)
Reading at malicious_x = 0xffffffffffdfeb76... Success: 0x67=’g’ score=15 (second best: 0x05=’?’ score=5)
Reading at malicious_x = 0xffffffffffdfeb77... Success: 0x69=’i’ score=51 (second best: 0x00=’?’ score=21)
Reading at malicious_x = 0xffffffffffdfeb78... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfeb79... Success: 0x20=’ ’ score=23 (second best: 0x00=’?’ score=11)
Reading at malicious_x = 0xffffffffffdfeb7a... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfeb7b... Success: 0x6F=’o’ score=7 (second best: 0x00=’?’ score=3)
Reading at malicious_x = 0xffffffffffdfeb7c... Success: 0x72=’r’ score=13 (second best: 0x00=’?’ score=6)
Reading at malicious_x = 0xffffffffffdfeb7d... Success: 0x64=’d’ score=13 (second best: 0x05=’?’ score=4)
Reading at malicious_x = 0xffffffffffdfeb7e... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfeb7f... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfeb80... Success: 0x61=’a’ score=15 (second best: 0x05=’?’ score=5)
Reading at malicious_x = 0xffffffffffdfeb81... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfeb82... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfeb83... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfeb84... Success: 0x53=’S’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb85... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfeb86... Success: 0x75=’u’ score=29 (second best: 0x00=’?’ score=14)
Reading at malicious_x = 0xffffffffffdfeb87... Success: 0x65=’e’ score=9 (second best: 0x05=’?’ score=2)
Reading at malicious_x = 0xffffffffffdfeb88... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfeb89... Success: 0x6D=’m’ score=21 (second best: 0x00=’?’ score=10)
Reading at malicious_x = 0xffffffffffdfeb8a... Success: 0x69=’i’ score=21 (second best: 0x00=’?’ score=10)
Reading at malicious_x = 0xffffffffffdfeb8b... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfeb8c... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfeb8d... Success: 0x20=’ ’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb8e... Success: 0x4F=’O’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb8f... Success: 0x73=’s’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb90... Success: 0x73=’s’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb91... Success: 0x69=’i’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb92... Success: 0x66=’f’ score=31 (second best: 0x00=’?’ score=15)
Reading at malicious_x = 0xffffffffffdfeb93... Success: 0x72=’r’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb94... Success: 0x61=’a’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb95... Success: 0x67=’g’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb96... Success: 0x65=’e’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeb97... Success: 0x2E=’.’ score=2 

NOCLFLUSH

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_NOT_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfec80... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfec81... Success: 0x68=’h’ score=2 (second best: 0x86=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfec82... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec83... Unclear: 0xCA=’?’ score=1 (second best: 0xBF=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfec84... Unclear: 0x4D=’M’ score=1 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfec85... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec86... Unclear: 0xCA=’?’ score=1 (second best: 0x67=’g’ score=1)
Reading at malicious_x = 0xffffffffffdfec87... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec88... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfec89... Success: 0x20=’ ’ score=1 
Reading at malicious_x = 0xffffffffffdfec8a... Success: 0x57=’W’ score=2 (second best: 0xCA=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfec8b... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfec8c... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec8d... Success: 0xFF=’?’ score=0 
Reading at malicious_x = 0xffffffffffdfec8e... Success: 0x73=’s’ score=1 
Reading at malicious_x = 0xffffffffffdfec8f... Success: 0x05=’?’ score=2 
Reading at malicious_x = 0xffffffffffdfec90... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec91... Unclear: 0x72=’r’ score=1 (second best: 0x66=’f’ score=1)
Reading at malicious_x = 0xffffffffffdfec92... Success: 0x65=’e’ score=2 (second best: 0xEA=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfec93... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec94... Success: 0x05=’?’ score=2 
Reading at malicious_x = 0xffffffffffdfec95... Unclear: 0xCA=’?’ score=1 (second best: 0x85=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfec96... Unclear: 0x75=’u’ score=1 (second best: 0x5D=’]’ score=1)
Reading at malicious_x = 0xffffffffffdfec97... Success: 0x65=’e’ score=2 (second best: 0xCA=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfec98... Unclear: 0x61=’a’ score=1 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfec99... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfec9a... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec9b... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec9c... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfec9d... Success: 0x20=’ ’ score=1 
Reading at malicious_x = 0xffffffffffdfec9e... Unclear: 0xCA=’?’ score=1 (second best: 0x4F=’O’ score=1)
Reading at malicious_x = 0xffffffffffdfec9f... Success: 0x05=’?’ score=2 
Reading at malicious_x = 0xffffffffffdfeca0... Success: 0x73=’s’ score=1 
Reading at malicious_x = 0xffffffffffdfeca1... Success: 0x69=’i’ score=2 (second best: 0xCA=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeca2... Success: 0x66=’f’ score=2 (second best: 0x22=’"’ score=1)
Reading at malicious_x = 0xffffffffffdfeca3... Unclear: 0xCA=’?’ score=1 (second best: 0x72=’r’ score=1)
Reading at malicious_x = 0xffffffffffdfeca4... Unclear: 0xCA=’?’ score=1 (second best: 0x61=’a’ score=1)
Reading at malicious_x = 0xffffffffffdfeca5... Unclear: 0x92=’?’ score=1 (second best: 0x87=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeca6... Success: 0x65=’e’ score=1 
Reading at malicious_x = 0xffffffffffdfeca7... Success: 0x05=’?’ score=2 

@Postrediori
Copy link
Contributor

OS

Windows 8.1 Professional x64

CPU

Intel(R) Core(TM) i3-2370M @ 2,40 GHz (SandyBridge)

Results

Compiled with VS2015 32-bit

C:\>"%VS140COMNTOOLS%/vsvars32.bat"
C:\>cl.exe /Od /Fespectre.exe spectre.c
C:\>spectre.exe
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 000000A0... Success: 0x54=ÆTÆ score=2
Reading at malicious_x = 000000A1... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = 000000A2... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000A3... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000A4... Success: 0x4D=ÆMÆ score=2
Reading at malicious_x = 000000A5... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000A6... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 000000A7... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 000000A8... Success: 0x63=ÆcÆ score=2
Reading at malicious_x = 000000A9... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000AA... Success: 0x57=ÆWÆ score=2
Reading at malicious_x = 000000AB... Success: 0x6F=ÆoÆ score=2
Reading at malicious_x = 000000AC... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 000000AD... Success: 0x64=ÆdÆ score=2
Reading at malicious_x = 000000AE... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000AF... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000B0... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000B1... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 000000B2... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000B3... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000B4... Success: 0x53=ÆSÆ score=2
Reading at malicious_x = 000000B5... Success: 0x71=ÆqÆ score=2
Reading at malicious_x = 000000B6... Success: 0x75=ÆuÆ score=2
Reading at malicious_x = 000000B7... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000B8... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000B9... Success: 0x6D=ÆmÆ score=2
Reading at malicious_x = 000000BA... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 000000BB... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000BC... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = 000000BD... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000BE... Success: 0x4F=ÆOÆ score=2
Reading at malicious_x = 000000BF... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000C0... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000C1... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 000000C2... Success: 0x66=ÆfÆ score=2
Reading at malicious_x = 000000C3... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 000000C4... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000C5... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 000000C6... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000C7... Success: 0x2E=Æ.Æ score=2

Compiled with VS2015 32-bit, NOCLFLUSH

C:\>"%VS140COMNTOOLS%/vsvars32.bat"
C:\>cl.exe /Od /Fespectre_noclflush.exe spectre.c -DNOCLFLUSH
C:\>spectre_noclflush.exe
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_NOT_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 000000A0... Success: 0xBD=Æ?Æ score=1
Reading at malicious_x = 000000A1... Unclear: 0x68=ÆhÆ score=1 (second best:
 0x59=ÆYÆ score=1)
Reading at malicious_x = 000000A2... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000A3... Success: 0x20=Æ Æ score=2 (second best:
 0x71=ÆqÆ score=1)
Reading at malicious_x = 000000A4... Success: 0x4D=ÆMÆ score=2
Reading at malicious_x = 000000A5... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000A6... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 000000A7... Unclear: 0x69=ÆiÆ score=2 (second best:
 0x21=Æ!Æ score=2)
Reading at malicious_x = 000000A8... Success: 0x63=ÆcÆ score=2 (second best:
 0xE9=Æ?Æ score=1)
Reading at malicious_x = 000000A9... Success: 0xE9=Æ?Æ score=2 (second best:
 0x59=ÆYÆ score=1)
Reading at malicious_x = 000000AA... Unclear: 0x57=ÆWÆ score=3 (second best:
 0xE9=Æ?Æ score=2)
Reading at malicious_x = 000000AB... Success: 0x6F=ÆoÆ score=2
Reading at malicious_x = 000000AC... Success: 0xE9=Æ?Æ score=2 (second best:
 0xBE=Æ?Æ score=1)
Reading at malicious_x = 000000AD... Success: 0x64=ÆdÆ score=2
Reading at malicious_x = 000000AE... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000AF... Success: 0x20=Æ Æ score=1
Reading at malicious_x = 000000B0... Unclear: 0xE9=Æ?Æ score=1 (second best:
 0x61=ÆaÆ score=1)
Reading at malicious_x = 000000B1... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 000000B2... Success: 0x65=ÆeÆ score=2 (second best:
 0xE9=Æ?Æ score=1)
Reading at malicious_x = 000000B3... Success: 0x20=Æ Æ score=1
Reading at malicious_x = 000000B4... Success: 0x53=ÆSÆ score=3 (second best:
 0xBD=Æ?Æ score=1)
Reading at malicious_x = 000000B5... Success: 0xE9=Æ?Æ score=1
Reading at malicious_x = 000000B6... Success: 0x75=ÆuÆ score=2
Reading at malicious_x = 000000B7... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000B8... Unclear: 0xE9=Æ?Æ score=1 (second best:
 0xDE=Æ?Æ score=1)
Reading at malicious_x = 000000B9... Success: 0x6D=ÆmÆ score=3 (second best:
 0xE9=Æ?Æ score=1)
Reading at malicious_x = 000000BA... Success: 0x69=ÆiÆ score=4 (second best:
 0xE9=Æ?Æ score=2)
Reading at malicious_x = 000000BB... Success: 0x73=ÆsÆ score=5 (second best:
 0xE9=Æ?Æ score=2)
Reading at malicious_x = 000000BC... Unclear: 0xDE=Æ?Æ score=1 (second best:
 0x68=ÆhÆ score=1)
Reading at malicious_x = 000000BD... Success: 0x20=Æ Æ score=4 (second best:
 0x21=Æ!Æ score=1)
Reading at malicious_x = 000000BE... Success: 0x4F=ÆOÆ score=2
Reading at malicious_x = 000000BF... Unclear: 0xBD=Æ?Æ score=1 (second best:
 0x73=ÆsÆ score=1)
Reading at malicious_x = 000000C0... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000C1... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 000000C2... Success: 0x66=ÆfÆ score=2
Reading at malicious_x = 000000C3... Success: 0x72=ÆrÆ score=4 (second best:
 0x87=Æ?Æ score=1)
Reading at malicious_x = 000000C4... Success: 0xE9=Æ?Æ score=1
Reading at malicious_x = 000000C5... Unclear: 0xE9=Æ?Æ score=1 (second best:
 0xDE=Æ?Æ score=1)
Reading at malicious_x = 000000C6... Success: 0x65=ÆeÆ score=4 (second best:
 0xBD=Æ?Æ score=1)
Reading at malicious_x = 000000C7... Unclear: 0xE9=Æ?Æ score=1 (second best:
 0x87=Æ?Æ score=1)

Compiled with VS2015 64-bit

C:\>"%VS140COMNTOOLS%../../VC/bin/amd64/vcvars64.bat"
C:\>cl.exe /Od /Fespectre.exe spectre.c
C:\>spectre.exe
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 00000000000000A8... Success: 0x54=ÆTÆ score=2
Reading at malicious_x = 00000000000000A9... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = 00000000000000AA... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000AB... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000AC... Success: 0x4D=ÆMÆ score=2
Reading at malicious_x = 00000000000000AD... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000AE... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 00000000000000AF... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 00000000000000B0... Success: 0x63=ÆcÆ score=2
Reading at malicious_x = 00000000000000B1... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000B2... Success: 0x57=ÆWÆ score=2
Reading at malicious_x = 00000000000000B3... Success: 0x6F=ÆoÆ score=2
Reading at malicious_x = 00000000000000B4... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 00000000000000B5... Success: 0x64=ÆdÆ score=2
Reading at malicious_x = 00000000000000B6... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 00000000000000B7... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000B8... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000B9... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 00000000000000BA... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000BB... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000BC... Success: 0x53=ÆSÆ score=2
Reading at malicious_x = 00000000000000BD... Success: 0x71=ÆqÆ score=2
Reading at malicious_x = 00000000000000BE... Success: 0x75=ÆuÆ score=2
Reading at malicious_x = 00000000000000BF... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000C0... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000C1... Success: 0x6D=ÆmÆ score=2
Reading at malicious_x = 00000000000000C2... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 00000000000000C3... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 00000000000000C4... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = 00000000000000C5... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000C6... Success: 0x4F=ÆOÆ score=2
Reading at malicious_x = 00000000000000C7... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 00000000000000C8... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 00000000000000C9... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 00000000000000CA... Success: 0x66=ÆfÆ score=2
Reading at malicious_x = 00000000000000CB... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 00000000000000CC... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000CD... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 00000000000000CE... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000CF... Success: 0x2E=Æ.Æ score=2

Compiled with VS2015 64-bit, NOCLFLUSH

C:\>"%VS140COMNTOOLS%../../VC/bin/amd64/vcvars64.bat"
C:\>cl.exe /Od /Fespectre_noclflush.exe spectre.c -DNOCLFLUSH
C:\>spectre_noclflush.exe
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_NOT_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 00000000000000A8... Success: 0x54=ÆTÆ score=2
Reading at malicious_x = 00000000000000A9... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000AA... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000AB... Success: 0x20=Æ Æ score=1
Reading at malicious_x = 00000000000000AC... Success: 0x4D=ÆMÆ score=1
Reading at malicious_x = 00000000000000AD... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000AE... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000AF... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000B0... Unclear: 0x63=ÆcÆ score=1 (second b
est: 0x0B=Æ?Æ score=1)
Reading at malicious_x = 00000000000000B1... Success: 0x0B=Æ?Æ score=1
Reading at malicious_x = 00000000000000B2... Unclear: 0x57=ÆWÆ score=1 (second b
est: 0x00=Æ?Æ score=1)
Reading at malicious_x = 00000000000000B3... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000B4... Success: 0x00=Æ?Æ score=1
Reading at malicious_x = 00000000000000B5... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000B6... Success: 0x73=ÆsÆ score=1
Reading at malicious_x = 00000000000000B7... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000B8... Success: 0x61=ÆaÆ score=2 (second b
est: 0x00=Æ?Æ score=1)
Reading at malicious_x = 00000000000000B9... Success: 0x72=ÆrÆ score=2 (second b
est: 0x0B=Æ?Æ score=1)
Reading at malicious_x = 00000000000000BA... Unclear: 0x65=ÆeÆ score=1 (second b
est: 0x0B=Æ?Æ score=1)
Reading at malicious_x = 00000000000000BB... Success: 0x0B=Æ?Æ score=2
Reading at malicious_x = 00000000000000BC... Success: 0x53=ÆSÆ score=2 (second b
est: 0x00=Æ?Æ score=1)
Reading at malicious_x = 00000000000000BD... Success: 0x00=Æ?Æ score=1
Reading at malicious_x = 00000000000000BE... Success: 0x00=Æ?Æ score=1
Reading at malicious_x = 00000000000000BF... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000C0... Success: 0x61=ÆaÆ score=1
Reading at malicious_x = 00000000000000C1... Success: 0x6D=ÆmÆ score=2
Reading at malicious_x = 00000000000000C2... Success: 0x69=ÆiÆ score=1
Reading at malicious_x = 00000000000000C3... Unclear: 0x73=ÆsÆ score=1 (second b
est: 0x0B=Æ?Æ score=1)
Reading at malicious_x = 00000000000000C4... Success: 0x0B=Æ?Æ score=1
Reading at malicious_x = 00000000000000C5... Success: 0x0B=Æ?Æ score=2
Reading at malicious_x = 00000000000000C6... Success: 0x4F=ÆOÆ score=1
Reading at malicious_x = 00000000000000C7... Unclear: 0x73=ÆsÆ score=1 (second b
est: 0x0B=Æ?Æ score=1)
Reading at malicious_x = 00000000000000C8... Unclear: 0x73=ÆsÆ score=1 (second b
est: 0x0B=Æ?Æ score=1)
Reading at malicious_x = 00000000000000C9... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000CA... Success: 0xFF=Æ?Æ score=0
Reading at malicious_x = 00000000000000CB... Unclear: 0x72=ÆrÆ score=1 (second b
est: 0x0B=Æ?Æ score=1)
Reading at malicious_x = 00000000000000CC... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000CD... Unclear: 0x67=ÆgÆ score=1 (second b
est: 0x0C=Æ?Æ score=1)
Reading at malicious_x = 00000000000000CE... Success: 0x65=ÆeÆ score=2 (second b
est: 0x0B=Æ?Æ score=1)
Reading at malicious_x = 00000000000000CF... Success: 0x2E=Æ.Æ score=2

@ghost
Copy link

ghost commented Feb 6, 2018

ArchLinux, Lenovo Ideapad Z575 laptop

Linux z5 4.15.0-gd8a5b80568a9 #182 SMP PREEMPT Mon Jan 29 22:21:39 CET 2018 x86_64 GNU/Linux
processor	: 3
vendor_id	: AuthenticAMD
cpu family	: 18
model		: 1
model name	: AMD A6-3400M APU with Radeon(tm) HD Graphics
stepping	: 0
microcode	: 0x3000027
cpu MHz		: 2168.522
cache size	: 1024 KB
physical id	: 0
siblings	: 4
core id		: 3
cpu cores	: 4
apicid		: 3
initial apicid	: 3
fpu		: yes
fpu_exception	: yes
cpuid level	: 6
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm 3dnowext 3dnow constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid aperfmperf pni monitor cx16 popcnt lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt cpb hw_pstate retpoline retpoline_amd rsb_ctxsw vmmcall arat npt lbrv svm_lock nrip_save pausefilter
bugs		: fxsave_leak sysret_ss_attrs null_seg spectre_v1 spectre_v2
bogomips	: 2794.98
TLB size	: 1536 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts ttp tm stc 100mhzsteps hwpstate cpb
cc -mindirect-branch=thunk -mindirect-branch-register -Ofast -std=c99 -O0 -o spectre.out spectre.c
$ ./spectre.out 
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee88... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfee89... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfee8a... Success: 0x65=’e’ score=7 (second best: 0xD6=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee8b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfee8c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfee8d... Success: 0x61=’a’ score=7 (second best: 0xEC=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee8e... Success: 0x67=’g’ score=7 (second best: 0xFC=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee8f... Success: 0x69=’i’ score=7 (second best: 0xF2=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee90... Success: 0x63=’c’ score=7 (second best: 0x77=’w’ score=1)
Reading at malicious_x = 0xffffffffffdfee91... Success: 0x20=’ ’ score=7 (second best: 0xD1=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee92... Success: 0x57=’W’ score=7 (second best: 0xE4=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee93... Success: 0x6F=’o’ score=7 (second best: 0xE6=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee94... Success: 0x72=’r’ score=7 (second best: 0xAB=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee95... Success: 0x64=’d’ score=7 (second best: 0xFF=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee96... Success: 0x73=’s’ score=7 (second best: 0x99=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee97... Success: 0x20=’ ’ score=7 (second best: 0x94=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee98... Success: 0x61=’a’ score=7 (second best: 0xA5=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee99... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfee9a... Success: 0x65=’e’ score=7 (second best: 0xAE=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9b... Success: 0x20=’ ’ score=7 (second best: 0xFC=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9c... Success: 0x53=’S’ score=7 (second best: 0xD3=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9d... Success: 0x71=’q’ score=7 (second best: 0xD7=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfee9e... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfee9f... Success: 0x65=’e’ score=7 (second best: 0xE6=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeea0... Success: 0x61=’a’ score=7 (second best: 0x5B=’[’ score=1)
Reading at malicious_x = 0xffffffffffdfeea1... Success: 0x6D=’m’ score=9 (second best: 0x9A=’?’ score=2)
Reading at malicious_x = 0xffffffffffdfeea2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfeea3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfeea4... Success: 0x68=’h’ score=7 (second best: 0xFA=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeea5... Success: 0x20=’ ’ score=7 (second best: 0x94=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeea6... Success: 0x4F=’O’ score=7 (second best: 0xF1=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeea7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfeea8... Success: 0x73=’s’ score=7 (second best: 0x9D=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeea9... Success: 0x69=’i’ score=7 (second best: 0xFE=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeeaa... Success: 0x66=’f’ score=7 (second best: 0xCF=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeeab... Success: 0x72=’r’ score=7 (second best: 0xDB=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeeac... Success: 0x61=’a’ score=7 (second best: 0xA5=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeead... Success: 0x67=’g’ score=7 (second best: 0x78=’x’ score=1)
Reading at malicious_x = 0xffffffffffdfeeae... Success: 0x65=’e’ score=7 (second best: 0xB0=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfeeaf... Success: 0x2E=’.’ score=2 

@HavocParasite
Copy link

HavocParasite commented Feb 8, 2018

OS ( uname -a )
ArchLinux
Linux havxpc 4.15.1-2-ARCH #1 SMP Sun Feb 4 22:27:45 UTC 2018 x86_64 GNU/Linux

CPU

processor : 0
vendor_id : AuthenticAMD
cpu family : 23
model : 1
model name : AMD Ryzen 7 1700 Eight-Core Processor
stepping : 1
microcode : 0x8001129
cpu MHz : 2564.026
cache size : 512 KB
physical id : 0
siblings : 16
core id : 0
cpu cores : 8
apicid : 0
initial apicid : 0
fpu : yes
fpu_exception : yes
cpuid level : 13
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb hw_pstate sme retpoline retpoline_amd vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 xsaves clzero irperf xsaveerptr arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif overflow_recov succor smca
bugs : sysret_ss_attrs null_seg spectre_v1 spectre_v2
bogomips : 5988.04
TLB size : 2560 4K pages
clflush size : 64
cache_alignment : 64
address sizes : 43 bits physical, 48 bits virtual
power management: ts ttp tm hwpstate eff_freq_ro [13] [14]

Results (CACHE_HIT_THRESHOLD = 100):

Using a cache hit threshold of 100.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee88... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfee89... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfee8a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee8b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee8c... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfee8d... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee8e... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfee8f... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee90... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfee91... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee92... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfee93... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfee94... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee95... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfee96... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee97... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee98... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee99... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee9a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee9b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee9c... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfee9d... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfee9e... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfee9f... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfeea0... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfeea1... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfeea2... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfeea3... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfeea4... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfeea5... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfeea6... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfeea7... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfeea8... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfeea9... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfeeaa... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfeeab... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfeeac... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfeead... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfeeae... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfeeaf... Success: 0x2E=’.’ score=2

@phizev
Copy link

phizev commented Feb 9, 2018

Kernel

Linux [hostname] 4.13.0-33-generic #36~16.04.1-Ubuntu SMP Wed Feb 7 23:32:33 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Processor

processor       : 0
vendor_id       : AuthenticAMD
cpu family      : 21
model           : 48
model name      : AMD A10-7850K Radeon R7, 12 Compute Cores 4C+8G
stepping        : 1
microcode       : 0x6003106
cpu MHz         : 1700.000
cache size      : 2048 KB
physical id     : 0
siblings        : 4
core id         : 0
cpu cores       : 2
apicid          : 16
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 13
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 popcnt aes xsave avx f16c lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs xop skinit wdt lwp fma4 tce nodeid_msr tbm topoext perfctr_core perfctr_nb bpext ptsc cpb hw_pstate retpoline retpoline_amd rsb_ctxsw vmmcall fsgsbase bmi1 xsaveopt arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold overflow_recov
bugs            : fxsave_leak sysret_ss_attrs null_seg spectre_v1 spectre_v2
bogomips        : 8400.15
TLB size        : 1536 4K pages
clflush size    : 64
cache_alignment : 64
address sizes   : 48 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate cpb eff_freq_ro [13]

Results

./spectre.out 115

Version: commit d8ff06846f48f56b75de5d7d6c988424a59927d5
Using a cache hit threshold of 115.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfeca8... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfeca9... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfecaa... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfecab... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfecac... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfecad... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfecae... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfecaf... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfecb0... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfecb1... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfecb2... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfecb3... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfecb4... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfecb5... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfecb6... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfecb7... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfecb8... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfecb9... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfecba... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfecbb... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfecbc... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfecbd... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfecbe... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfecbf... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfecc0... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfecc1... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfecc2... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfecc3... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfecc4... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfecc5... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfecc6... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfecc7... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfecc8... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfecc9... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfecca... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfeccb... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfeccc... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfeccd... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfecce... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfeccf... Success: 0x2E=’.’ score=2

./spectre.out

Version: commit d8ff06846f48f56b75de5d7d6c988424a59927d5
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfeca8... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfeca9... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecaa... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecab... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecac... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecad... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecae... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecaf... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb0... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb1... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb2... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb3... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb4... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb5... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb6... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb7... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb8... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecb9... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecba... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecbb... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecbc... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecbd... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecbe... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecbf... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc0... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc1... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc2... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc3... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc4... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc5... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc6... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc7... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc8... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecc9... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecca... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfeccb... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfeccc... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfeccd... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfecce... Success: 0xFF=’?’ score=0
Reading at malicious_x = 0xffffffffffdfeccf... Success: 0xFF=’?’ score=0

As an addendum, this processor is undervolted, and overclocked, stock is 3.7 GHz with 4.0 GHz boost, this one has 4.2 GHz as its highest scaling frequency via an increased multiplier. Results were much the same at stock, though I think it might have needed a cache hit threshold of 120 at stock.

@fuadbagus
Copy link

fuadbagus commented Feb 11, 2018

OS

Darwin MacBook-Pro-2.local 17.4.0 Darwin Kernel Version 17.4.0: 
Sun Dec 17 09:19:54 PST 2017; 
root:xnu-4570.41.2~1/RELEASE_X86_64 x86_64

CPU

machdep.cpu.max_basic: 20
machdep.cpu.max_ext: 2147483656
machdep.cpu.vendor: GenuineIntel
machdep.cpu.brand_string: Intel(R) Core(TM) i7-5557U CPU @ 3.10GHz
machdep.cpu.family: 6
machdep.cpu.model: 61
machdep.cpu.extmodel: 3
machdep.cpu.extfamily: 0
machdep.cpu.stepping: 4
machdep.cpu.feature_bits: 9221959987971750911
machdep.cpu.leaf7_feature_bits: 35399595
machdep.cpu.extfeature_bits: 1241984796928
machdep.cpu.signature: 198356
machdep.cpu.brand: 0
machdep.cpu.features: FPU VME DE PSE TSC MSR PAE MCE CX8 APIC SEP MTRR PGE MCA CMOV PAT PSE36 CLFSH DS ACPI MMX FXSR SSE SSE2 SS HTT TM PBE SSE3 PCLMULQDQ DTES64 MON DSCPL VMX EST TM2 SSSE3 FMA CX16 TPR PDCM SSE4.1 SSE4.2 x2APIC MOVBE POPCNT AES PCID XSAVE OSXSAVE SEGLIM64 TSCTMR AVX1.0 RDRAND F16C
machdep.cpu.leaf7_features: SMEP ERMS RDWRFSGS TSC_THREAD_OFFSET BMI1 AVX2 BMI2 INVPCID SMAP RDSEED ADX IPT FPU_CSDS
machdep.cpu.extfeatures: SYSCALL XD 1GBPAGE EM64T LAHF LZCNT PREFETCHW RDTSCP TSCI
machdep.cpu.logical_per_package: 16
machdep.cpu.cores_per_package: 8
machdep.cpu.microcode_version: 33
machdep.cpu.processor_flag: 6
machdep.cpu.mwait.linesize_min: 64
machdep.cpu.mwait.linesize_max: 64
machdep.cpu.mwait.extensions: 3
machdep.cpu.mwait.sub_Cstates: 286531872
machdep.cpu.thermal.sensor: 1
machdep.cpu.thermal.dynamic_acceleration: 1
machdep.cpu.thermal.invariant_APIC_timer: 1
machdep.cpu.thermal.thresholds: 2
machdep.cpu.thermal.ACNT_MCNT: 1
machdep.cpu.thermal.core_power_limits: 1
machdep.cpu.thermal.fine_grain_clock_mod: 1
machdep.cpu.thermal.package_thermal_intr: 1
machdep.cpu.thermal.hardware_feedback: 0
machdep.cpu.thermal.energy_policy: 1
machdep.cpu.xsave.extended_state: 7 832 832 0
machdep.cpu.xsave.extended_state1: 1 0 0 0
machdep.cpu.arch_perf.version: 3
machdep.cpu.arch_perf.number: 4
machdep.cpu.arch_perf.width: 48
machdep.cpu.arch_perf.events_number: 7
machdep.cpu.arch_perf.events: 0
machdep.cpu.arch_perf.fixed_number: 3
machdep.cpu.arch_perf.fixed_width: 48
machdep.cpu.cache.linesize: 64
machdep.cpu.cache.L2_associativity: 8
machdep.cpu.cache.size: 256
machdep.cpu.tlb.inst.large: 8
machdep.cpu.tlb.data.small: 64
machdep.cpu.tlb.data.small_level1: 64
machdep.cpu.address_bits.physical: 39
machdep.cpu.address_bits.virtual: 48
machdep.cpu.core_count: 2
machdep.cpu.thread_count: 4
machdep.cpu.tsc_ccc.numerator: 0
machdep.cpu.tsc_ccc.denominator: 0

Results

spectre.out Version: commit d8ff068

Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xfffffffffffffe1a... Unclear: 0x54=’T’ score=975 (second best: 0x00=’?’ score=735)
Reading at malicious_x = 0xfffffffffffffe1b... Unclear: 0x68=’h’ score=992 (second best: 0x00=’?’ score=790)
Reading at malicious_x = 0xfffffffffffffe1c... Success: 0x65=’e’ score=405 (second best: 0x00=’?’ score=200)
Reading at malicious_x = 0xfffffffffffffe1d... Unclear: 0x20=’ ’ score=945 (second best: 0x00=’?’ score=649)
Reading at malicious_x = 0xfffffffffffffe1e... Unclear: 0x4D=’M’ score=946 (second best: 0x00=’?’ score=791)
Reading at malicious_x = 0xfffffffffffffe1f... Success: 0x61=’a’ score=833 (second best: 0x02=’?’ score=414)
Reading at malicious_x = 0xfffffffffffffe20... Unclear: 0x67=’g’ score=991 (second best: 0x00=’?’ score=711)
Reading at malicious_x = 0xfffffffffffffe21... Unclear: 0x69=’i’ score=987 (second best: 0x00=’?’ score=784)
Reading at malicious_x = 0xfffffffffffffe22... Unclear: 0x63=’c’ score=949 (second best: 0x00=’?’ score=670)
Reading at malicious_x = 0xfffffffffffffe23... Unclear: 0x20=’ ’ score=947 (second best: 0x00=’?’ score=705)
Reading at malicious_x = 0xfffffffffffffe24... Unclear: 0x57=’W’ score=961 (second best: 0x00=’?’ score=837)
Reading at malicious_x = 0xfffffffffffffe25... Unclear: 0x6F=’o’ score=945 (second best: 0x00=’?’ score=684)
Reading at malicious_x = 0xfffffffffffffe26... Unclear: 0x72=’r’ score=998 (second best: 0x00=’?’ score=740)
Reading at malicious_x = 0xfffffffffffffe27... Unclear: 0x64=’d’ score=958 (second best: 0x00=’?’ score=648)
Reading at malicious_x = 0xfffffffffffffe28... Unclear: 0x73=’s’ score=993 (second best: 0x00=’?’ score=771)
Reading at malicious_x = 0xfffffffffffffe29... Unclear: 0x20=’ ’ score=949 (second best: 0x00=’?’ score=847)
Reading at malicious_x = 0xfffffffffffffe2a... Unclear: 0x61=’a’ score=964 (second best: 0x00=’?’ score=614)
Reading at malicious_x = 0xfffffffffffffe2b... Unclear: 0x72=’r’ score=992 (second best: 0x00=’?’ score=810)
Reading at malicious_x = 0xfffffffffffffe2c... Unclear: 0x65=’e’ score=960 (second best: 0x00=’?’ score=817)
Reading at malicious_x = 0xfffffffffffffe2d... Unclear: 0x20=’ ’ score=955 (second best: 0x00=’?’ score=773)
Reading at malicious_x = 0xfffffffffffffe2e... Unclear: 0x53=’S’ score=994 (second best: 0x00=’?’ score=641)
Reading at malicious_x = 0xfffffffffffffe2f... Unclear: 0x71=’q’ score=947 (second best: 0x00=’?’ score=775)
Reading at malicious_x = 0xfffffffffffffe30... Unclear: 0x75=’u’ score=987 (second best: 0x00=’?’ score=623)
Reading at malicious_x = 0xfffffffffffffe31... Success: 0x65=’e’ score=377 (second best: 0x02=’?’ score=186)
Reading at malicious_x = 0xfffffffffffffe32... Unclear: 0x61=’a’ score=972 (second best: 0x00=’?’ score=666)
Reading at malicious_x = 0xfffffffffffffe33... Unclear: 0x6D=’m’ score=964 (second best: 0x00=’?’ score=863)
Reading at malicious_x = 0xfffffffffffffe34... Unclear: 0x69=’i’ score=980 (second best: 0x00=’?’ score=700)
Reading at malicious_x = 0xfffffffffffffe35... Success: 0x73=’s’ score=63 (second best: 0x02=’?’ score=29)
Reading at malicious_x = 0xfffffffffffffe36... Unclear: 0x68=’h’ score=986 (second best: 0x00=’?’ score=719)
Reading at malicious_x = 0xfffffffffffffe37... Unclear: 0x20=’ ’ score=940 (second best: 0x00=’?’ score=750)
Reading at malicious_x = 0xfffffffffffffe38... Unclear: 0x4F=’O’ score=930 (second best: 0x00=’?’ score=563)
Reading at malicious_x = 0xfffffffffffffe39... Unclear: 0x73=’s’ score=987 (second best: 0x00=’?’ score=647)
Reading at malicious_x = 0xfffffffffffffe3a... Unclear: 0x73=’s’ score=988 (second best: 0x00=’?’ score=648)
Reading at malicious_x = 0xfffffffffffffe3b... Unclear: 0x69=’i’ score=979 (second best: 0x00=’?’ score=663)
Reading at malicious_x = 0xfffffffffffffe3c... Unclear: 0x66=’f’ score=929 (second best: 0x00=’?’ score=762)
Reading at malicious_x = 0xfffffffffffffe3d... Unclear: 0x72=’r’ score=993 (second best: 0x00=’?’ score=627)
Reading at malicious_x = 0xfffffffffffffe3e... Unclear: 0x61=’a’ score=967 (second best: 0x00=’?’ score=691)
Reading at malicious_x = 0xfffffffffffffe3f... Unclear: 0x67=’g’ score=991 (second best: 0x00=’?’ score=657)
Reading at malicious_x = 0xfffffffffffffe40... Unclear: 0x65=’e’ score=958 (second best: 0x00=’?’ score=731)
Reading at malicious_x = 0xfffffffffffffe41... Unclear: 0x2E=’.’ score=943 (second best: 0x00=’?’ score=682)

@pavlinux
Copy link

./spectre.out 160
Version: commit 874a037
Using a cache hit threshold of 160.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee78... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfee79... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfee7a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee7b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee7c... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfee7d... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee7e... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfee7f... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee80... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfee81... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee82... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfee83... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfee84... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee85... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfee86... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee87... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee88... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee89... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee8a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee8b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee8c... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfee8d... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfee8e... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfee8f... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee90... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee91... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfee92... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee93... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee94... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfee95... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee96... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfee97... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee98... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee99... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee9a... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfee9b... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee9c... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee9d... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfee9e... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee9f... Success: 0x2E=’.’ score=2

AMD Opteron(tm) Processor 4386

@Jury76
Copy link

Jury76 commented Apr 19, 2018

TL;DR: "We're all fucked. I'm fucked. You're fucked. The whole department's fucked. It's been the biggest cock-up ever and we're all completely fucked." - Andrew Rawnsley

system info

This is how low can my cpu go. (By that, I mean below that number and it just shows ?s.)

linuxgeek@linuxgeek-HP-15-Notebook-PC:~/SpectrePoC-master$ ./spectre.out 26
Using a cache hit threshold of 26.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfeeb8... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfeeb9... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfeeba... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfeebb... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfeebc... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfeebd... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfeebe... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfeebf... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfeec0... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfeec1... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfeec2... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfeec3... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfeec4... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfeec5... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfeec6... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfeec7... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfeec8... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfeec9... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfeeca... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfeecb... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfeecc... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfeecd... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfeece... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfeecf... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfeed0... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfeed1... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfeed2... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfeed3... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfeed4... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfeed5... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfeed6... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfeed7... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfeed8... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfeed9... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfeeda... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfeedb... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfeedc... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfeedd... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfeede... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfeedf... Success: 0x2E=’.’ score=2

@hawkinsw
Copy link
Contributor

Thank you!

Thank you for spiffing up the example code in the paper to the point where I can simply run

make

and have it work. A great community service. My results are below!

OS

Linux dmh 3.13.0-39-generic #66-Ubuntu SMP Tue Oct 28 13:30:27 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

CPU

vendor_id       : GenuineIntel
cpu family      : 6
model           : 45
model name      : Intel(R) Xeon(R) CPU E5-1620 0 @ 3.60GHz
stepping        : 7
microcode       : 0x70d
cpu MHz         : 1200.000
cache size      : 10240 KB

Results

Version: commit 874a03775dc68433e0c2b43e3c3f6e97652fa86a
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfeb98... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfeb99... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfeb9a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfeb9b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfeb9c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfeb9d... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfeb9e... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfeb9f... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfeba0... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfeba1... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfeba2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfeba3... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfeba4... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfeba5... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfeba6... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfeba7... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfeba8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfeba9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebaa... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebab... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebac... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfebad... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfebae... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfebaf... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebb0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebb1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfebb2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebb3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebb4... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebb5... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebb6... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfebb7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebbc... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0x2E=’.’ score=2 

@Postrediori
Copy link
Contributor

In April 2018 Intel released an updated micro-code for Sandy Bridge. Nevertheless, this PoC is still functional, only now the threshold must be greater (150 instead of 80).

OS

Windows 8.1 Professional x64

CPU

Intel(R) Core(TM) i3-2370M @ 2,40 GHz (SandyBridge)

VS2015 Community 32-bit

C:\> spectre.exe 150
Using a cache hit threshold of 150.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED
Reading 40 bytes:
Reading at malicious_x = 000000A0... Success: 0x54=ÆTÆ score=2
Reading at malicious_x = 000000A1... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = 000000A2... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000A3... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000A4... Success: 0x4D=ÆMÆ score=2
Reading at malicious_x = 000000A5... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000A6... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 000000A7... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 000000A8... Success: 0x63=ÆcÆ score=2
Reading at malicious_x = 000000A9... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000AA... Success: 0x57=ÆWÆ score=2
Reading at malicious_x = 000000AB... Success: 0x6F=ÆoÆ score=2
Reading at malicious_x = 000000AC... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 000000AD... Success: 0x64=ÆdÆ score=2
Reading at malicious_x = 000000AE... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000AF... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000B0... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000B1... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 000000B2... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000B3... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000B4... Success: 0x53=ÆSÆ score=2
Reading at malicious_x = 000000B5... Success: 0x71=ÆqÆ score=2
Reading at malicious_x = 000000B6... Success: 0x75=ÆuÆ score=2
Reading at malicious_x = 000000B7... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000B8... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000B9... Success: 0x6D=ÆmÆ score=2
Reading at malicious_x = 000000BA... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 000000BB... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000BC... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = 000000BD... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 000000BE... Success: 0x4F=ÆOÆ score=2
Reading at malicious_x = 000000BF... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000C0... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 000000C1... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 000000C2... Success: 0x66=ÆfÆ score=2
Reading at malicious_x = 000000C3... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 000000C4... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 000000C5... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 000000C6... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 000000C7... Success: 0x2E=Æ.Æ score=2

VS2015 Community 64-bit

C:\> spectre_x64.exe 150
Using a cache hit threshold of 150.                                       
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED                
Reading 40 bytes:                                                         
Reading at malicious_x = 00000000000000A8... Success: 0x54=ÆTÆ score=2
Reading at malicious_x = 00000000000000A9... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = 00000000000000AA... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000AB... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000AC... Success: 0x4D=ÆMÆ score=2
Reading at malicious_x = 00000000000000AD... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000AE... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 00000000000000AF... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 00000000000000B0... Success: 0x63=ÆcÆ score=2
Reading at malicious_x = 00000000000000B1... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000B2... Success: 0x57=ÆWÆ score=2
Reading at malicious_x = 00000000000000B3... Success: 0x6F=ÆoÆ score=2
Reading at malicious_x = 00000000000000B4... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 00000000000000B5... Success: 0x64=ÆdÆ score=2
Reading at malicious_x = 00000000000000B6... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 00000000000000B7... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000B8... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000B9... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 00000000000000BA... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000BB... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000BC... Success: 0x53=ÆSÆ score=2
Reading at malicious_x = 00000000000000BD... Success: 0x71=ÆqÆ score=2
Reading at malicious_x = 00000000000000BE... Success: 0x75=ÆuÆ score=2
Reading at malicious_x = 00000000000000BF... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000C0... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000C1... Success: 0x6D=ÆmÆ score=2
Reading at malicious_x = 00000000000000C2... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 00000000000000C3... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 00000000000000C4... Success: 0x68=ÆhÆ score=2
Reading at malicious_x = 00000000000000C5... Success: 0x20=Æ Æ score=2
Reading at malicious_x = 00000000000000C6... Success: 0x4F=ÆOÆ score=2
Reading at malicious_x = 00000000000000C7... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 00000000000000C8... Success: 0x73=ÆsÆ score=2
Reading at malicious_x = 00000000000000C9... Success: 0x69=ÆiÆ score=2
Reading at malicious_x = 00000000000000CA... Success: 0x66=ÆfÆ score=2
Reading at malicious_x = 00000000000000CB... Success: 0x72=ÆrÆ score=2
Reading at malicious_x = 00000000000000CC... Success: 0x61=ÆaÆ score=2
Reading at malicious_x = 00000000000000CD... Success: 0x67=ÆgÆ score=2
Reading at malicious_x = 00000000000000CE... Success: 0x65=ÆeÆ score=2
Reading at malicious_x = 00000000000000CF... Success: 0x2E=Æ.Æ score=2

@crozone
Copy link
Owner Author

crozone commented Apr 30, 2018

OS

Linux SB2-RYAN 4.4.0-43-Microsoft #1-Microsoft Wed Dec 31 14:42:53 PST 2014 x86_64 GNU/Linux

CPU

vendor_id       : GenuineIntel
cpu family      : 6
model           : 142
model name      : Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
stepping        : 10
microcode       : 0xffffffff
cpu MHz         : 2112.000
cache size      : 256 KB

Results

Version: commit 9337eaa1d5878ac761a4378a406ace99785a573b
Using a cache hit threshold of 20.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED MITIGATION_DISABLED
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfee88... Unclear: 0x54=’T’ score=865 (second best: 0x00=’?’ score=473)
Reading at malicious_x = 0xffffffffffdfee89... Success: 0x68=’h’ score=101 (second best: 0x00=’?’ score=48)
Reading at malicious_x = 0xffffffffffdfee8a... Success: 0x65=’e’ score=47 (second best: 0x00=’?’ score=21)
Reading at malicious_x = 0xffffffffffdfee8b... Success: 0x20=’ ’ score=729 (second best: 0x00=’?’ score=362)
Reading at malicious_x = 0xffffffffffdfee8c... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfee8d... Success: 0x61=’a’ score=481 (second best: 0x00=’?’ score=236)
Reading at malicious_x = 0xffffffffffdfee8e... Success: 0x67=’g’ score=851 (second best: 0x00=’?’ score=423)
Reading at malicious_x = 0xffffffffffdfee8f... Unclear: 0x69=’i’ score=915 (second best: 0x6A=’j’ score=506)
Reading at malicious_x = 0xffffffffffdfee90... Success: 0x63=’c’ score=25 (second best: 0x05=’?’ score=10)
Reading at malicious_x = 0xffffffffffdfee91... Success: 0x20=’ ’ score=65 (second best: 0x00=’?’ score=26)
Reading at malicious_x = 0xffffffffffdfee92... Success: 0x57=’W’ score=215 (second best: 0x00=’?’ score=105)
Reading at malicious_x = 0xffffffffffdfee93... Success: 0x6F=’o’ score=95 (second best: 0x05=’?’ score=45)
Reading at malicious_x = 0xffffffffffdfee94... Success: 0x72=’r’ score=59 (second best: 0x00=’?’ score=27)
Reading at malicious_x = 0xffffffffffdfee95... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfee96... Success: 0x73=’s’ score=209 (second best: 0x05=’?’ score=102)
Reading at malicious_x = 0xffffffffffdfee97... Success: 0x20=’ ’ score=173 (second best: 0x05=’?’ score=84)
Reading at malicious_x = 0xffffffffffdfee98... Success: 0x61=’a’ score=83 (second best: 0x62=’b’ score=39)
Reading at malicious_x = 0xffffffffffdfee99... Unclear: 0x72=’r’ score=802 (second best: 0x05=’?’ score=582)
Reading at malicious_x = 0xffffffffffdfee9a... Success: 0x65=’e’ score=187 (second best: 0x05=’?’ score=91)
Reading at malicious_x = 0xffffffffffdfee9b... Success: 0x20=’ ’ score=107 (second best: 0x05=’?’ score=51)
Reading at malicious_x = 0xffffffffffdfee9c... Success: 0x53=’S’ score=121 (second best: 0x05=’?’ score=58)
Reading at malicious_x = 0xffffffffffdfee9d... Success: 0x71=’q’ score=19 (second best: 0x05=’?’ score=7)
Reading at malicious_x = 0xffffffffffdfee9e... Unclear: 0x75=’u’ score=23 (second best: 0x00=’?’ score=13)
Reading at malicious_x = 0xffffffffffdfee9f... Success: 0x65=’e’ score=39 (second best: 0x05=’?’ score=17)
Reading at malicious_x = 0xffffffffffdfeea0... Success: 0x61=’a’ score=29 (second best: 0x00=’?’ score=12)
Reading at malicious_x = 0xffffffffffdfeea1... Success: 0x6D=’m’ score=21 (second best: 0x05=’?’ score=8)
Reading at malicious_x = 0xffffffffffdfeea2... Success: 0x69=’i’ score=635 (second best: 0x6A=’j’ score=315)
Reading at malicious_x = 0xffffffffffdfeea3... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfeea4... Success: 0x68=’h’ score=459 (second best: 0x00=’?’ score=228)
Reading at malicious_x = 0xffffffffffdfeea5... Success: 0x20=’ ’ score=23 (second best: 0x05=’?’ score=9)
Reading at malicious_x = 0xffffffffffdfeea6... Success: 0x4F=’O’ score=95 (second best: 0x05=’?’ score=45)
Reading at malicious_x = 0xffffffffffdfeea7... Success: 0x73=’s’ score=145 (second best: 0x00=’?’ score=70)
Reading at malicious_x = 0xffffffffffdfeea8... Success: 0x73=’s’ score=337 (second best: 0x05=’?’ score=166)
Reading at malicious_x = 0xffffffffffdfeea9... Success: 0x69=’i’ score=191 (second best: 0x00=’?’ score=93)
Reading at malicious_x = 0xffffffffffdfeeaa... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfeeab... Success: 0x72=’r’ score=91 (second best: 0x00=’?’ score=43)
Reading at malicious_x = 0xffffffffffdfeeac... Success: 0x61=’a’ score=19 (second best: 0x05=’?’ score=7)
Reading at malicious_x = 0xffffffffffdfeead... Success: 0x67=’g’ score=91 (second best: 0x00=’?’ score=44)
Reading at malicious_x = 0xffffffffffdfeeae... Success: 0x65=’e’ score=93 (second best: 0x05=’?’ score=44)
Reading at malicious_x = 0xffffffffffdfeeaf... Success: 0x2E=’.’ score=121 (second best: 0x00=’?’ score=58)

@illustris
Copy link

OS

Linux 850EVO 4.15.0-15-generic #16-Ubuntu SMP Wed Apr 4 13:58:14 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

CPU

vendor_id	: GenuineIntel
cpu family	: 6
model		: 70
model name	: Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz
stepping	: 1
microcode	: 0x19
cpu MHz		: 1693.355
cache size	: 6144 KB

Results

Version: commit a5331a24b7a31a25c35391885fd263ed9cee741a
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED MITIGATION_DISABLED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfef28... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfef29... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfef2a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfef2b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfef2c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfef2d... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfef2e... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfef2f... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfef30... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfef31... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfef32... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfef33... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfef34... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfef35... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfef36... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfef37... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfef38... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfef39... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfef3a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfef3b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfef3c... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfef3d... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfef3e... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfef3f... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfef40... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfef41... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfef42... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfef43... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfef44... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfef45... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfef46... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfef47... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfef48... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfef49... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfef4a... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfef4b... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfef4c... Success: 0x61=’a’ score=7 (second best: 0x05=’?’ score=1)
Reading at malicious_x = 0xffffffffffdfef4d... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfef4e... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfef4f... Success: 0x2E=’.’ score=2

@helvete
Copy link

helvete commented Oct 13, 2018

OS

Linux workstation 3.16.0-4-amd64 #1 SMP Debian 3.16.51-3 (2017-12-13) x86_64 GNU/Linux

CPU

vendor_id	: AuthenticAMD
cpu family	: 15
model		: 107
model name	: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+
stepping	: 2
cpu MHz		: 2600.000
cache size	: 512 KB

RESULTS

Version: commit 856f80f2937f2bb812cab68d45c149272a1783d5
Using a cache hit threshold of 35.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED INTEL_MITIGATION_DISABLED LINUX_KERNEL_MITIGATION_DISABLED 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdffa18... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdffa19... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdffa1a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffa1b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffa1c... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdffa1d... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffa1e... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdffa1f... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffa20... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdffa21... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffa22... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdffa23... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdffa24... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffa25... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdffa26... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffa27... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffa28... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffa29... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffa2a... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffa2b... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffa2c... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdffa2d... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdffa2e... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdffa2f... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffa30... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffa31... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdffa32... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffa33... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffa34... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdffa35... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffa36... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdffa37... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffa38... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffa39... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffa3a... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdffa3b... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffa3c... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffa3d... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdffa3e... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffa3f... Success: 0x2E=’.’ score=2

Works well for CH thresholds of 35 and higher

@Postrediori
Copy link
Contributor

Many years, BIOS updates and Windows updates later.

OS

Windows 10 Enterprise 22H2 19045.3693 x64

CPU

Intel(R) Core(TM) i3-7100 @ 3,90 GHz (KabyLake)

Visual Studio 2017 Community x64

> cl.exe /Od /Fespectre_x64.exe spectre.c
> spectre_x64.exe
Using a cache hit threshold of 80.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED INTEL_MITIGATION_DISABLED LINUX_KERNEL_MITIGATION_DISABLED
Reading 40 bytes:
Reading at malicious_x = 0000000000000018... Success: 0x54=’T’ score=7 (second best: 0x7C=’|’ score=1)
Reading at malicious_x = 0000000000000019... Success: 0x0B=’?’ score=2
Reading at malicious_x = 000000000000001A... Success: 0x65=’e’ score=2
Reading at malicious_x = 000000000000001B... Success: 0x20=’ ’ score=2
Reading at malicious_x = 000000000000001C... Success: 0x4D=’M’ score=2
Reading at malicious_x = 000000000000001D... Success: 0x06=’?’ score=2
Reading at malicious_x = 000000000000001E... Success: 0x06=’?’ score=2
Reading at malicious_x = 000000000000001F... Success: 0x69=’i’ score=17 (second best: 0x06=’?’ score=6)
Reading at malicious_x = 0000000000000020... Success: 0x63=’c’ score=9 (second best: 0x06=’?’ score=2)
Reading at malicious_x = 0000000000000021... Success: 0x20=’ ’ score=7 (second best: 0xFB=’?’ score=1)
Reading at malicious_x = 0000000000000022... Success: 0x57=’W’ score=2
Reading at malicious_x = 0000000000000023... Success: 0x6F=’o’ score=11 (second best: 0x7C=’|’ score=3)
Reading at malicious_x = 0000000000000024... Success: 0x72=’r’ score=7 (second best: 0x0B=’?’ score=1)
Reading at malicious_x = 0000000000000025... Success: 0x64=’d’ score=7 (second best: 0x7C=’|’ score=1)
Reading at malicious_x = 0000000000000026... Success: 0x73=’s’ score=30 (second best: 0x06=’?’ score=14)
Reading at malicious_x = 0000000000000027... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0000000000000028... Success: 0x61=’a’ score=2
Reading at malicious_x = 0000000000000029... Success: 0x72=’r’ score=2
Reading at malicious_x = 000000000000002A... Success: 0x65=’e’ score=7 (second best: 0x8F=’?’ score=1)
Reading at malicious_x = 000000000000002B... Success: 0x20=’ ’ score=2
Reading at malicious_x = 000000000000002C... Success: 0x53=’S’ score=7 (second best: 0x06=’?’ score=1)
Reading at malicious_x = 000000000000002D... Success: 0x71=’q’ score=7 (second best: 0xC8=’?’ score=1)
Reading at malicious_x = 000000000000002E... Success: 0x75=’u’ score=2
Reading at malicious_x = 000000000000002F... Success: 0x65=’e’ score=2
Reading at malicious_x = 0000000000000030... Success: 0x61=’a’ score=2
Reading at malicious_x = 0000000000000031... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0000000000000032... Success: 0x69=’i’ score=13 (second best: 0x06=’?’ score=4)
Reading at malicious_x = 0000000000000033... Success: 0x73=’s’ score=9 (second best: 0x7C=’|’ score=2)
Reading at malicious_x = 0000000000000034... Success: 0x68=’h’ score=2
Reading at malicious_x = 0000000000000035... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0000000000000036... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0000000000000037... Success: 0x73=’s’ score=2
Reading at malicious_x = 0000000000000038... Success: 0x73=’s’ score=2
Reading at malicious_x = 0000000000000039... Success: 0x69=’i’ score=2
Reading at malicious_x = 000000000000003A... Success: 0x66=’f’ score=2
Reading at malicious_x = 000000000000003B... Success: 0x72=’r’ score=2
Reading at malicious_x = 000000000000003C... Success: 0x61=’a’ score=2
Reading at malicious_x = 000000000000003D... Success: 0x67=’g’ score=2
Reading at malicious_x = 000000000000003E... Success: 0x65=’e’ score=2
Reading at malicious_x = 000000000000003F... Success: 0x2E=’.’ score=2

Visual Studio 2017 Community x32

> cl.exe /Od /Fespectre_x86.exe spectre.c
> spectre_x86.exe
spectre_x86.exe 150
Using a cache hit threshold of 150.
Build: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED INTEL_MITIGATION_DISABLED LINUX_KERNEL_MITIGATION_DISABLED
Reading 40 bytes:
Reading at malicious_x = 00000014... Success: 0x11=’?’ score=2
Reading at malicious_x = 00000015... Success: 0x68=’h’ score=2
Reading at malicious_x = 00000016... Success: 0x65=’e’ score=2
Reading at malicious_x = 00000017... Success: 0x20=’ ’ score=2
Reading at malicious_x = 00000018... Success: 0x4D=’M’ score=7 (second best: 0x68=’h’ score=1)
Reading at malicious_x = 00000019... Success: 0x61=’a’ score=2
Reading at malicious_x = 0000001A... Success: 0x67=’g’ score=7 (second best: 0x22=’"’ score=1)
Reading at malicious_x = 0000001B... Success: 0x11=’?’ score=2
Reading at malicious_x = 0000001C... Success: 0x63=’c’ score=2
Reading at malicious_x = 0000001D... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0000001E... Success: 0x57=’W’ score=2
Reading at malicious_x = 0000001F... Success: 0x6F=’o’ score=2
Reading at malicious_x = 00000020... Success: 0x72=’r’ score=7 (second best: 0x11=’?’ score=1)
Reading at malicious_x = 00000021... Success: 0x64=’d’ score=2
Reading at malicious_x = 00000022... Success: 0x73=’s’ score=2
Reading at malicious_x = 00000023... Success: 0x20=’ ’ score=7 (second best: 0x70=’p’ score=1)
Reading at malicious_x = 00000024... Success: 0x61=’a’ score=17 (second best: 0x11=’?’ score=6)
Reading at malicious_x = 00000025... Success: 0x72=’r’ score=2
Reading at malicious_x = 00000026... Success: 0x65=’e’ score=2
Reading at malicious_x = 00000027... Success: 0x20=’ ’ score=11 (second best: 0x11=’?’ score=3)
Reading at malicious_x = 00000028... Success: 0x53=’S’ score=7 (second best: 0x18=’?’ score=1)
Reading at malicious_x = 00000029... Success: 0x71=’q’ score=9 (second best: 0x65=’e’ score=2)
Reading at malicious_x = 0000002A... Success: 0x75=’u’ score=7 (second best: 0xD4=’?’ score=1)
Reading at malicious_x = 0000002B... Success: 0x65=’e’ score=2
Reading at malicious_x = 0000002C... Success: 0x61=’a’ score=7 (second best: 0x3B=’;’ score=1)
Reading at malicious_x = 0000002D... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0000002E... Success: 0x11=’?’ score=7 (second best: 0x07=’?’ score=1)
Reading at malicious_x = 0000002F... Success: 0x73=’s’ score=7 (second best: 0x08=’?’ score=1)
Reading at malicious_x = 00000030... Success: 0x68=’h’ score=9 (second best: 0x08=’?’ score=2)
Reading at malicious_x = 00000031... Success: 0x20=’ ’ score=11 (second best: 0x11=’?’ score=3)
Reading at malicious_x = 00000032... Success: 0x4F=’O’ score=2
Reading at malicious_x = 00000033... Success: 0x73=’s’ score=2
Reading at malicious_x = 00000034... Success: 0x73=’s’ score=2
Reading at malicious_x = 00000035... Success: 0x11=’?’ score=2
Reading at malicious_x = 00000036... Success: 0x11=’?’ score=2
Reading at malicious_x = 00000037... Success: 0x72=’r’ score=2
Reading at malicious_x = 00000038... Success: 0x61=’a’ score=7 (second best: 0x68=’h’ score=1)
Reading at malicious_x = 00000039... Success: 0x67=’g’ score=7 (second best: 0x10=’?’ score=1)
Reading at malicious_x = 0000003A... Success: 0x65=’e’ score=2
Reading at malicious_x = 0000003B... Success: 0x2E=’.’ score=25 (second best: 0x11=’?’ score=10)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests