{"id":13539206,"url":"https://github.com/crozone/spectrepoc","last_synced_at":"2025-04-06T02:11:38.049Z","repository":{"id":54823647,"uuid":"116326868","full_name":"crozone/SpectrePoC","owner":"crozone","description":"Proof of concept code for the Spectre CPU exploit.","archived":false,"fork":false,"pushed_at":"2023-01-28T15:47:51.000Z","size":70,"stargazers_count":305,"open_issues_count":4,"forks_count":89,"subscribers_count":23,"default_branch":"master","last_synced_at":"2025-03-30T01:11:15.575Z","etag":null,"topics":["exploit","linux","poc","spectre","spectreexploit-poc"],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/crozone.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-01-05T01:46:15.000Z","updated_at":"2025-03-23T10:04:49.000Z","dependencies_parsed_at":"2023-02-15T17:30:31.285Z","dependency_job_id":null,"html_url":"https://github.com/crozone/SpectrePoC","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/crozone%2FSpectrePoC","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/crozone%2FSpectrePoC/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/crozone%2FSpectrePoC/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/crozone%2FSpectrePoC/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/crozone","download_url":"https://codeload.github.com/crozone/SpectrePoC/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247423515,"owners_count":20936626,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["exploit","linux","poc","spectre","spectreexploit-poc"],"created_at":"2024-08-01T09:01:21.727Z","updated_at":"2025-04-06T02:11:38.020Z","avatar_url":"https://github.com/crozone.png","language":"C","readme":"# SpectrePoC\n\nProof of concept code for the Spectre CPU exploit.\n\n## Attribution\n\nThe source code originates from the example code provided in the \"Spectre Attacks: Exploiting Speculative Execution\" paper found here:\n\nhttps://spectreattack.com/spectre.pdf\n\nThe original source code used in this repository was conveniently provided by Erik August's gist, found here: https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9e3d4bb6\n\nThe code has been modified to fix build issues, add workaround for older CPUs, and improve comments where possible.\n\n## Building\n\nThe project can be built with GNU Make and GCC.\n\nOn debian these are included in the `build-essential` metapackage.\n\nBuilding is as easy as:\n\n`cd SpectrePoC`\n\n`make`\n\nThe output binary is `./spectre.out`.\n\n### Mitigations\n\nSeveral mitigations are available for Spectre.\n\nThese can be can be optionally compiled into the binary in order to test their effectiveness on various processors.\n\n#### Intel lfence style mitigation\n\nIf you want to build a version with Intel's lfence mitigation included, set your `CFLAGS`\n\n`CFLAGS=-DINTEL_MITIGATION`\n\nin the `Makefile` or build like\n\n`CFLAGS=-DINTEL_MITIGATION make`\n\n#### Linux kernel style mitigation\n\nIf you want to build a version with Linux kernel array_index_mask_nospec() mitigation included, set your `CFLAGS`\n\n`CFLAGS=-DLINUX_KERNEL_MITIGATION`\n\nin the `Makefile` or build like\n\n`CFLAGS=-DLINUX_KERNEL_MITIGATION make`\n\n### Building for older CPUs\n\nDepending on the CPU, certain instructions will need to be disabled in order for the program to run correctly.\n\nThe instructions in question are:\n\n#### rdtscp:\n\nIntroduced with x86-64.\nAll 32-bit only CPUs, including many Core 2 Duos, will need to disable this instruction.\n\nTo build the project without `rdtscp`, define the NORDTSCP cflag:\n\n`CFLAGS=-DNORDTSCP make` \n\n#### mfence:\nIntroduced with SSE2.\nMost CPUs pre-Pentium 4 will need to disable this instruction.\n\nTo build the project without `mfence`, define the NOMFENCE cflag:\n\n`CFLAGS=-DNOMFENCE make`\n\n#### clflush\nIntroduced with SSE2.\nMost CPUs pre-Pentium 4 will need to disable this instruction.\n\nTo build the project without `clflush`, define the NOCLFLUSH cflag:\n\n`CFLAGS=-DNOCLFLUSH make`\n\n#### Multiple cflags\n\nTo define multiple cflags, separate each cflag with an escaped space. For example:\n\n`CFLAGS=-DNORDTSCP\\ -DNOMFENCE\\ -DNOCLFLUSH make`\n\n#### SSE2 instruction set\n\nTo build the project without all of the above instructions introduced with SSE2, define NOSSE2 cflag:\n\n`CFLAGS=-DNOSSE2 make`\n\n`NOSSE2` is automatically enabled if the `__SSE__` flag is present but `__SSE2__` is absent.\nThis means `NOSSE2` shouldn't need to be manually specified when compiling on Clang or GCC on non-SSE2 processors.\n\nOn MSC, `NOSSE2` is automatically enabled if the `_M_IX86_FP` flag is set to `1` (indicating SSE support, but no SSE2 support).\nMSC will set this by default for all x86 processors.\n\n#### 'Target specific option mismatch' error\n\nSome 32-bit versions of gcc (e.g. the version used in Ubuntu 14.04) may show the following error while compiling the PoC:\n\n```\n/usr/lib/gcc/i686-linux-gnu/5/include/emmintrin.h:1479:1: error:\n  inlining failed in call to always_inline\n`_mm_clflush`: target specific option mismatch\n _mm_clflush (void const *__A)\n ^\n```\n\nIn this case architecture build flag `-march=native` is required for compilation for the current CPU:\n\n`CFLAGS=-march=native make`\n\nThis flag builds the binary specifically for the current CPU and it may crash after copying to another machine.\n\n### Building it without using the Makefile\n\nIf you want to build it manually, make sure to disable all optimisations (aka, don't use -O2), as it will break the program.\n\n## Executing\n\nTo run spectre with default cache hit threshold of 80, and the secret example string \"The Magic Words are Squeamish Ossifrage.\" as the target, run `./spectre.out` with no command line arguments.\n\n**Example:** `./spectre.out`\n\nThe cache hit threshold can be specified as the first command line argument. It must be a whole positive integer.\n\n**Example:** `./spectre.out 80`\n\nA custom target address and length can be given as the second and third command line arguments, respectively.\n\n**Example:** `./spectre.out 80 12345678 128`\n\n## Tweaking\n\nIf you're getting lackluster results, you may need to tweak the cache hit threshold. This can be done by providing a threshold as the first command line argument.\n\nWhile a value of 80 appears to work for most desktop CPUs, a larger value may be required for slower CPUs, and the newest desktop CPUs can go as low as 15.\nFor example, on an Intel(R) Core(TM) i7-8650U CPU (Surface Book 2), a value of 20 works well. On a slower, integrated AMD GX-412TC SOC (PC Engines APU3), a value of 100-300 was required to get a good result.\n\n## Contributing\n\nFeel free to add your results to the \"Results\" issue. Include your cache hit threshold, OS details, CPU details like vendor Id, family, model name, stepping, microcode, MHz, and cache size. The OS can be found by running `uname -a`. CPU info can be found by running `cat /proc/cpuinfo` on Linux, and `sysctl -a | grep machdep.cpu` on OSX.\n\n## Example output\n\nThe following was output on an Intel(R) Core(TM) i7-8650U CPU, with a cache hit threshold of 20:\n\n`./spectre.out 20:`\n\n```\nVersion: commit 04c47db298920eb4d1b7c1bafcd0017a72d415bc\nUsing a cache hit threshold of 20.\nBuild: RDTSCP_SUPPORTED MFENCE_SUPPORTED CLFLUSH_SUPPORTED INTEL_MITIGATION_DISABLED LINUX_KERNEL_MITIGATION_DISABLED\nReading 40 bytes:\nReading at malicious_x = 0xffffffffffdfeeb8... Success: 0x54=’T’ score=187 (second best: 0x00=’?’ score=92)\nReading at malicious_x = 0xffffffffffdfeeb9... Unclear: 0x68=’h’ score=967 (second best: 0x00=’?’ score=486)\nReading at malicious_x = 0xffffffffffdfeeba... Unclear: 0x65=’e’ score=985 (second best: 0x00=’?’ score=566)\nReading at malicious_x = 0xffffffffffdfeebb... Unclear: 0x20=’ ’ score=965 (second best: 0x00=’?’ score=659)\nReading at malicious_x = 0xffffffffffdfeebc... Unclear: 0x4D=’M’ score=978 (second best: 0x00=’?’ score=700)\nReading at malicious_x = 0xffffffffffdfeebd... Unclear: 0x61=’a’ score=967 (second best: 0x00=’?’ score=654)\nReading at malicious_x = 0xffffffffffdfeebe... Success: 0x67=’g’ score=705 (second best: 0x00=’?’ score=345)\nReading at malicious_x = 0xffffffffffdfeebf... Unclear: 0x69=’i’ score=974 (second best: 0x6A=’j’ score=768)\nReading at malicious_x = 0xffffffffffdfeec0... Unclear: 0x63=’c’ score=615 (second best: 0x00=’?’ score=310)\nReading at malicious_x = 0xffffffffffdfeec1... Success: 0x20=’ ’ score=2\nReading at malicious_x = 0xffffffffffdfeec2... Success: 0x57=’W’ score=13 (second best: 0x00=’?’ score=3)\nReading at malicious_x = 0xffffffffffdfeec3... Success: 0x6F=’o’ score=17 (second best: 0x00=’?’ score=1)\nReading at malicious_x = 0xffffffffffdfeec4... Success: 0x72=’r’ score=11 (second best: 0x00=’?’ score=4)\nReading at malicious_x = 0xffffffffffdfeec5... Unclear: 0x64=’d’ score=7 (second best: 0x00=’?’ score=6)\nReading at malicious_x = 0xffffffffffdfeec6... Success: 0x73=’s’ score=31 (second best: 0x00=’?’ score=13)\nReading at malicious_x = 0xffffffffffdfeec7... Unclear: 0x20=’ ’ score=7 (second best: 0x00=’?’ score=6)\nReading at malicious_x = 0xffffffffffdfeec8... Success: 0x61=’a’ score=43 (second best: 0x00=’?’ score=20)\nReading at malicious_x = 0xffffffffffdfeec9... Success: 0x72=’r’ score=189 (second best: 0x00=’?’ score=91)\nReading at malicious_x = 0xffffffffffdfeeca... Success: 0x65=’e’ score=2\nReading at malicious_x = 0xffffffffffdfeecb... Unclear: 0x20=’ ’ score=7 (second best: 0x00=’?’ score=6)\nReading at malicious_x = 0xffffffffffdfeecc... Unclear: 0x53=’S’ score=151 (second best: 0x00=’?’ score=78)\nReading at malicious_x = 0xffffffffffdfeecd... Success: 0x71=’q’ score=57 (second best: 0x00=’?’ score=26)\nReading at malicious_x = 0xffffffffffdfeece... Success: 0x00=’?’ score=5\nReading at malicious_x = 0xffffffffffdfeecf... Success: 0x65=’e’ score=33 (second best: 0x00=’?’ score=14)\nReading at malicious_x = 0xffffffffffdfeed0... Success: 0x61=’a’ score=115 (second best: 0x62=’b’ score=55)\nReading at malicious_x = 0xffffffffffdfeed1... Unclear: 0x6D=’m’ score=21 (second best: 0x00=’?’ score=15)\nReading at malicious_x = 0xffffffffffdfeed2... Unclear: 0x69=’i’ score=961 (second best: 0x6A=’j’ score=593)\nReading at malicious_x = 0xffffffffffdfeed3... Success: 0x73=’s’ score=37 (second best: 0x00=’?’ score=18)\nReading at malicious_x = 0xffffffffffdfeed4... Success: 0x68=’h’ score=253 (second best: 0x00=’?’ score=122)\nReading at malicious_x = 0xffffffffffdfeed5... Unclear: 0x20=’ ’ score=9 (second best: 0x00=’?’ score=5)\nReading at malicious_x = 0xffffffffffdfeed6... Success: 0x4F=’O’ score=315 (second best: 0x00=’?’ score=156)\nReading at malicious_x = 0xffffffffffdfeed7... Success: 0x73=’s’ score=21 (second best: 0x00=’?’ score=8)\nReading at malicious_x = 0xffffffffffdfeed8... Success: 0x73=’s’ score=27 (second best: 0x00=’?’ score=9)\nReading at malicious_x = 0xffffffffffdfeed9... Success: 0x69=’i’ score=51 (second best: 0x00=’?’ score=16)\nReading at malicious_x = 0xffffffffffdfeeda... Success: 0x66=’f’ score=2\nReading at malicious_x = 0xffffffffffdfeedb... Unclear: 0x72=’r’ score=53 (second best: 0x00=’?’ score=31)\nReading at malicious_x = 0xffffffffffdfeedc... Success: 0x61=’a’ score=7 (second best: 0x00=’?’ score=3)\nReading at malicious_x = 0xffffffffffdfeedd... Success: 0x67=’g’ score=2\nReading at malicious_x = 0xffffffffffdfeede... Success: 0x65=’e’ score=2\nReading at malicious_x = 0xffffffffffdfeedf... Success: 0x2E=’.’ score=35 (second best: 0x00=’?’ score=8)\n```\n","funding_links":[],"categories":["\u003ca id=\"683b645c2162a1fce5f24ac2abfa1973\"\u003e\u003c/a\u003e漏洞\u0026\u0026漏洞管理\u0026\u0026漏洞发现/挖掘\u0026\u0026漏洞开发\u0026\u0026漏洞利用\u0026\u0026Fuzzing"],"sub_categories":["\u003ca id=\"41ae40ed61ab2b61f2971fea3ec26e7c\"\u003e\u003c/a\u003e漏洞利用"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrozone%2Fspectrepoc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcrozone%2Fspectrepoc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrozone%2Fspectrepoc/lists"}