一句话：揭示自修改代码引发的指令缓存时序差异，据此提出更精确的缓存攻击及基于硬件计数器的检测方法。
自修改代码（SMC）能让程序在 x86 处理器上修改自身指令以优化性能，但其独特的微架构行为也可能被恶意利用。本文研究特定 x86 指令如何影响指令缓存行，造成缓存命中与未命中之间可测量的时序差异，这些差异使缓存攻击的噪声更低、效果更好。作者提出新颖的攻击技术，利用这些时序变化增强 Prime+Probe 和 Flush+Reload 等已有方法，从而更精确地攻击密码密钥，并在多种 x86 平台上构造类似 Spectre 的隐蔽信道。最后，论文提出一种利用硬件性能计数器的动态检测方法，以缓解这些增强型威胁。
Self-modifying code (SMC) allows programs to alter their own instructions, optimizing performance and functionality on x86 processors. Despite its benefits, SMC introduces unique microarchitectural behaviors that can be exploited for malicious purposes. In this paper, we explore the security implications of SMC by examining how specific x86 instructions affecting instruction cache lines lead to measurable timing discrepancies between cache hits and misses. These discrepancies facilitate refined cache attacks, making them less noisy and more effective. We introduce novel attack techniques that leverage these timing variations to enhance existing methods such as Prime+Probe and Flush+Reload. Our advanced techniques allow adversaries to more precisely attack cryptographic keys and create covert channels akin to Spectre across various x86 platforms. Finally, we propose a dynamic detection methodology utilizing hardware performance counters to mitigate these enhanced threats.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2502-05429,
title = {SMaCk: Efficient Instruction Cache Attacks via Self-Modifying Code Conflicts},
author = {Seonghun Son and Daniel Moghimi and Berk Gulmezoglu},
booktitle = {ASPLOS},
year = {2025},
doi = {10.1145/3676641.3716274}
}