Upload File

aslr on the line · l1 l2 l3 (last level cache), shared between cores ddr memory cpu core l1 l2 cpu...

  • Home
  • Documents
  • ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data
137
ASLR on the Line Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, Cris �ano Giuffrida VUSec

Upload: others

Post on 13-Oct-2020

32 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

ASLR on the LineBen Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, Cris�ano Giuffrida

VUSec

Page 2: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Erik Bosman @brainsmoke

Page 3: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Ben Gras @bjg

Kaveh Razavi @gober

Stephan van Schaik

Page 4: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data
Page 5: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

ASLR

Page 6: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Address Space Layout Randomiza�on

Widely deployed exploit mi�ga�on strategy:

Choose a different loca�on for code and data

every �me a process is run.

Page 7: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 8: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 9: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 10: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 11: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 12: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 13: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 14: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Address Space Layout Randomiza�on

Makes life for exploit writers a bit more

difficult.

Usually exploits need to know the loca�on

of certain data in memory.

Page 15: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

A Single Leak Reveals

-- Joshua Drake

Page 16: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Address Space Layout Randomiza�on

Exploit writers need to find a bug which leaks

addresses without crashing the program.

... or do they?

Page 17: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

This Presenta�on:

A side-channel a�ack on processes bakedinto the hardware to discover ASLRinforma�on from Javascript in the browser.

ASLR Cache (AnC)⊕

Page 18: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU CoreL1

L2

L3 (Last Level Cache), shared between cores

DDR Memory

CPU CoreL1

L2

CPU CoreL1

L2

CPU CoreL1

L2

Modern CPU architectures

Page 19: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

Page 20: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

Page 21: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

Page 22: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

MMU

virtualaddress

physical address

Page 23: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

physical address

MMUTLB

cache

Page 24: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

physical address

MMUTLB

cachePT

walk

miss

Page 25: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

physical address

MMUTLB

cachePT

walk

miss

Page 26: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Timers in Javascript

Page 27: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

t0=performance.now();

operation();

t1=performance.now();t = t1-t0; m

easu

red

�m

e

real �me

Page 28: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

t0=performance.now();

operation();

t1=performance.now();t = t1-t0; m

easu

red

�m

e

real �me

Page 29: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

t0=performance.now();

operation();

t1=performance.now();t = t1-t0; m

easu

red

�m

e

real �me

a�er an�- side-channel mi�ga�ons (firefox)a�er an�- side-channel mi�ga�ons (firefox)

Page 30: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)

Page 31: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)

Page 32: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)

Page 33: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)

Page 34: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)a�er an�- side-channel mi�ga�ons (firefox)

Page 35: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (chrome)a�er an�- side-channel mi�ga�ons (chrome)

Page 36: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

new SharedArrayBuffer()

Page 37: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

memory which may be shared between

mul�ple worker threads.

new SharedArrayBuffer()

Page 38: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

enabled by default by Firefox, Chromeand Edge since 2017

memory which may be shared betweenmul�ple worker threads.

new SharedArrayBuffer()

Page 39: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

let SharedRowhammerBuffer = SharedArrayBuffer;

Page 40: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 41: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 42: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 43: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 44: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 45: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 46: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 47: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Cache Side-Channels

Page 48: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

cache line (64 bytes)

memory

memory access

data physical address

Page 49: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

N-way associa�vecache set

1 cache set

memory

memory access

data physical address

Page 50: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...2048 cache sets with 64 byte cache lines

memory

memory access

data physical address

Page 51: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...

as many slices as cores

...

...

...memory

memory access

data physical address

Page 52: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...

memory

memory access

data physical address

Page 53: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...cache_set = (addr >> 6) % 2048,

direct mapping,repeated every 128KB

memory

memory access

data physical address

Page 54: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...cache_set = (addr >> 6) % 2048,

cache_slice = xor_hash(addr)

direct mapping,

repeated every 128KB

memory

memory access

data physical address

Page 55: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

cache_set = (addr >> 6) % 2048,direct mapping,

repeated every 128KB

memory

memory access

data physical address

Page 56: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

cache_set = (addr >> 6) % 2048,

two cache lines mapping to the same cache sethave the same physical address modulo 128KB

direct mapping,repeated every 128KB

memory

memory access

data physical address

Page 57: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

cache_set = (addr >> 6) % 2048,

two cache lines mapping to the same cache sethave the same physical address modulo 4KB

direct mapping,repeated every 128KB

memory

memory access

data physical address

Page 58: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

two cache linesmapping to thesame cache sethave the sameoffset into theirmemory page

memory

memory access

data physical address

1 page =64 cache lines

Page 59: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Page 60: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

evict(line_x);time();t0 = time();operation();t = time()-t0;

Page 61: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

evict(line_x);time();t0 = time();operation();t = time()-t0;

Page 62: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Xmybuf

X

X

X

...

evict(line_x);time();t0 = time();operation();t = time()-t0;

Page 63: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Xmybuf

X

X

X

...

evict(line_x);time();t0 = time();operation();t = time()-t0;X X X X X X X X X X X X

...

Page 64: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Xmybuf

X

X

X

...

evict(line_x);time();t0 = time();operation();t = time()-t0;X X X X X X X X X X X X

...

Page 65: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Xmybuf

X

X

X

...

evict(line_x);time();t0 = time();operation();t = time()-t0;X X X X X X X X X X X X

...

trigger memory access (or not)

Page 66: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

physical address

MMUTLB

cachePT

walk

miss

Page 67: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Page Tables

Page 68: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 69: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

512 entriescovering512GB each

0

248-1

Page 70: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3512 entriescovering1GB each

0

248-1

Page 71: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3512 entriescovering2MB each

0

248-1

Page 72: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

512 entriespoin�ngto 4096 byteregions inmemory 0

248-1

Page 73: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

0

248-1

Page 74: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

7F83B6372040virtual address lookup (x86_64)

Page 75: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

7F83B6372040virtual address lookup (x86_64)

7 F 8 3 B 6 3 7 3 0 4 0

Page 76: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

TLB miss!

Page 77: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

Page 78: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

512entries

0

511

Page 79: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

512entries

0

511

Page 80: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

512entries

Page 81: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14

512entries

Page 82: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14

512entries

Page 83: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433

512entries

Page 84: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433

512entries

Page 85: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

512entries

Page 86: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

actualdata

Page 87: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

actualdata

64

Page 88: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

actualdata

4K page

64

Page 89: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

Page 90: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

Page 91: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

address informa�on is directly encoded

into the page table lookups, and pagetables are pages themselves.

Observa�on:

Page 92: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

Page 93: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

4K page 4K page4K page 4K page

Page 94: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

4K page 4K page4K page 4K page

Page 95: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

Page 96: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

255254253252251

250249248

256

247

255

Page 97: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

?

......

255254253252251

250249248

256

247

255

1 Cache line =64 bytes =8 possible page table entries

Page 98: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

?

......

255254253252251

250249248

256

247

255

1 Cache line =64 bytes =8 possible page table entries

Page 99: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

?

......

255254253252251

250249248

256

247

255

1 Cache line =64 bytes =8 possible page table entries

cache line reveals 6 address bits

Page 100: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

Page 101: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

Page 102: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

loca�on withinthe page known

by studyingbrowser

memory allocator

Page 103: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

Page 104: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

max entropy le�:

Page 105: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

max entropy le�:

Page 106: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

max entropy le�: 4*3 bits + ...

Page 107: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

which hit belongs to which cache line?

max entropy le�: 4*3 bits + ...

Page 108: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

which hit belongs to which cache line?

max entropy le�: 4*3 bits + log2( 4 * 3 * 2 * 1 )

Page 109: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

which hit belongs to which cache line?

max entropy le�: ~ 16.6 bits

Page 110: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

allocate a buffer

perform this side-channel a�ack on bufferentries 4096 bytes apart

measure when the page table lookupcrosses a cache line boundary

Sliding

Page 111: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

370

Page 112: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

371

+4096 bytes

Page 113: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

372

+4096 bytes+4096 bytes

Page 114: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

373

+4096 bytes+4096 bytes

+4096 bytes

Page 115: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

374

+4096 bytes+4096 bytes

+4096 bytes

+4096 bytes

Page 116: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

375

+4096 bytes+4096 bytes

+4096 bytes

+4096 bytes

+4096 bytes

Page 117: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

376

+4096 bytes+4096 bytes

+4096 bytes

+4096 bytes

+4096 bytes+4096 bytes

......

375374373372371

370369368367

376

Page 118: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

we can do the same thing for the 2ndlevel page table

Sliding

Page 119: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

433

Page 120: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

434

+2MB

Page 121: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

435

+2MB

+2MB

Page 122: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

436

+2MB+2MB+2MB

Page 123: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

437

+2MB+2MB+2MB+2MB

Page 124: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

438

+2MB+2MB+2MB+2MB+2MB

Page 125: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

439

+2MB+2MB+2MB+2MB+2MB+2MB

Page 126: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

440

+2MB+2MB+2MB+2MB+2MB+2MB

+2MB

Page 127: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ?

Page 128: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ?

Page 129: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ?

max entropy le�: 2*3 + log2(2 * 1) = 7 bits

Page 130: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

1514131211

1098

16

7

+1GB

14

Page 131: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

255254253252251

250249248

256

247

255

+512GB

Page 132: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Firefox (on Linux) does not ini�alizeArrayBuffers, so linux does not allocatespace for the actual pages

We can allocate huge chunks and usesliding to recover the whole address

Alloca�ng large chunks of memory

Page 133: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Chrome does ini�alize memory, butjumps ahead in the address space every�me it creates a new heap

3rd level address bits can be recovered,4'th level bits needs chrome toini�alize/free up to 4TB :-)

Alloca�ng large chunks of memory

Page 134: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Model Microarchitecture Year

Intel Xeon E3-1240 v5 Skylake 2015

Intel Core i7-6700K Skylake 2015

Intel Celeron N2840 Silvermont 2014

Intel Xeon E5-2658 v2 Ivy Bridge EP 2013

Intel Atom C2750 Silvermont 2013

Intel Core i7-4500U Haswell 2013

Intel Core i7-3632QM Ivy Bridge 2012

Intel Core i7-2620QM Sandy Bridge 2011

Intel Core i5 M480 Westmere 2010

Intel Core i7 920 Nehalem 2008

AMD FX-8350 8-Core Piledriver 2012

AMD FX-8320 8-Core Piledriver 2012

AMD FX-8120 8-Core Bulldozer 2011

AMD Athlon II 640 X4 K10 2010

AMD E-350 Bobcat 2010

AMD Phenom 9550 4-Core K10 2008

Allwinner A64 ARM Cortex A53 2016

Samsung Exynos 5800 ARM Cortex A15 2014

Samsung Exynos 5800 ARM Cortex A7 2014

Nvidia Tegra K1 CD580M-A1 ARM Cortex A15 2014

Nvidia Tegra K1 CD570M-A1 ARM Cortex A15; LPAE 2014

This side-channelwas detected on22 out of 22 testedarchitectures!

Page 135: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Demo video

Page 136: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Conclusions

- Browser vendors seem to have given up on protec�ng against side-channel a�acks in favor of adding features :,-(

- It's possible to perform cache side-channel a�acks from Javascript on the Memory Managment Unit to recover ASLR informa�on

Page 137: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Any Ques�ons?

VUSecproject page:h�ps://vusec.net/projects/anc


Cpu Cacheline False Sharing - lrita.github.io · 5 Jiri Olsa, Joe Mario Resolving a memory access – more expensive case. CPU4 CPU5 CPU6 CPU7 L1 L1 L1 L1 L2 L2 L2 Memory (foo’s

L1-N / L1-L2 L2-N / L2-L3 L3-N / L3-L1 - file.yizimg.comfile.yizimg.com/313301/2012080722284624.pdf · Page 10 Strommessung/Current Measurement k l L1 L2 L3 k l k l 57 106 89 Spannungsmessung

Pshycholinguistic - L1 and L2 Acquisition

Pshycholinguistic L1 and L2 Acquistion

WINDOWSXP L1 L2

12-L1-L2-Pumps etc.ppt

MATHS L1 L2 L1 L2 L1/L2 Algèbre - Furet

IBM zEC12 Processor Subsystem · 2013-08-16 · Inclusive L4 LRU Cast-Out CP Stores Data Fetch Return 48MB eDRAM Inclusive L3 L1 2MB L2 L1 2MB L2 L1 2MB2MB L2 L1 2MB L2 L1 2MB L2

L1 L2 - cdn.mycomandia.com

Static Toolholders DIN 69880 - eyar.co.il Toolholders Catalog.pdf · Toolholders DIN 69880. 24 25 l1 l2 d4 d3 d1 l1 d1 l2 d4 d2 l1 l2 d4 d3 d1 l1 d1 l2 d4 d2 l1 l2 d4 d3 d1 l1 d1

L1 L2 L1 L2 L2 Économie monétaire et financière ÉconomieMacroéconomie ÉCO ÉCO Macroéconomie L1 L2 DANS LA MÊME COLLECTION ÉconomieMacroéconomie monétaire et financière

Concetti fondamentali delle reti · 2015-03-03 · Trasporto Rete Data Link Fisico Applicaz. Trasporto Rete Data Link Fisico Rete L2 L1 L2 L1 Rete L2 L1 L2 L1 L2 IP ... protocollo

Windows Mac OS X [10.8+] - Attasaattasa.com/madcatz/support/pdf/MCB32266-MUG-R2-10... · l2 l1 l2 r2 r2 r1 l2 l1 r1 l1 r2 r1 l2 l1 l2 r2 r1 l1 r2 r1 l2 l1 l2 r2.10.11. fcc id: p25d243710a4512c

CVEN 345 Quiz B Problem 1 L1 L2 R1 P R2 L1 L2...L1 L2 L3 L1 L2 L3 m2=1*L3 m1=1*L3 m1=1*L3 m3=1*(L1+L2) M0 M1 = - P*L1 L1 L2 L3 m4=1*L2 P DeltaLittle11 = Integral(m1*m1*dx)/EI Volume

Licence – Master - Doctorat (LMD) · droit … …à qui ne ... L1,L2,L3,M1,M2 L1 L2 L3 L1,L2,L3 Parlebas L1,L2,L3 20 Par le bas. Le contexte du LMD Réorganisation des enseignements

L1,L2 - Coroziunea Suprafetelor Metalice

Optimizing OpenCLTM on CPUs - khronos.org · Optimizing OpenCL TM on CPUs Ofer Rosenberg Visual Computing Software ... (HW threads) … L1 L2 L1 L2 L1 L2 L3 L1 ... Intel to use code

Hello from the Other Side: SSH over Robust Cache …...hash function maps a physical address to a slice 4/25 Caches on Intel CPUs core0 L1 L2 core1 L1 L2 core2 L1 L2 core3 L1 L2 ring

L1 L2 L1 L2 L2 Statistique inférentielle

Principles of Program Analysis: Abstract Interpretationriis/PPA/slides4.pdf · Program analysis: p ‘ l1 l2 where l1,l2 ∈ L. Note: should be deterministic: fp(l1) = l2. What is

download.rd.go.thdownload.rd.go.th/fileadmin/images/image_auction/doc4_maair56.pdf · ( ) ตรวจวัดกระแสไฟฟ้า(a.) l1 l2 l3 l1 l2 l3 เครื่องที่

Effects of L1 orthography and L1 phonology on L2 …centaur.reading.ac.uk/77792/1/Mairano_Bassetti_Sokolovic...Effects of L1 orthography and L1 phonology on L2 English pronunciation

Programme de formation L1,L2

A63 L1&L2 Service Manual.pdf

ocw.mit.edu · l1 l2 l1 < l2 l1, l2 = number of data. Title: 02-head.dvi

SiCOMPACT R3 MAXI - dammedia.osram.info · pe n l1/l2/l3 n l l1 l2 n n l2 l1 380 400 420 230v l vg/ballast n b n 400v vg/ballast l2/l3/l1 l l1/l2/l3 pe n lb la lb n b/lpb n pe b b/lpa

Wyszki CBK - Nowy szablon€¦ · Moc maksymalna 4,00 kW 15,05 kW 3,90 kW 2,00 kW 2,00 kW 5,30 kW Oznaczenia zacisków L1, L2, L3 L1, L2, L3 L1, L2, L3 L1, L2, L3 L1, L2, L3 L1, L2,

Contents · Contents Introduction ... Trimble NetR5 GPS L1 C/A Code, L2C, L1/L2/L51 Full Cycle Carrier, GLONASS L1 C/A Code, L1 P Code, L2 P Code, L1/L2 Full Cycle Carrier with

L1, L2- Introduction

Brochure L1-L2 MASS 2010

SETTLE - bene · © Bene GmBH, 01/2020 8 SeTTLe FARBen & mATeRIALIen FARBEN & MATERIALIEN L1 Ivory L2 Olive L2 Orange L1 nature L2 Kiwi L2 Safran L1 Coffee L2 moss L2 Taupe

Bilingualisam L1 and L2

Blood physiology L1 & L2

Граф / Graf Тумба RTV3SГраф / Graf 5 / 7 Тумба RTV3S A B A=B I II III e2 p38 k38\3 k38\7 k38\3 k38\3 p38 p38 d37 7 6 l2 l2 l2 l1 l1 l2 l2 l1 l1 l2 ~ 5 2 3 l2 m m

Neat L1 L2 L1 L2 1:21:41:8 dilution Coomassie SYPRO L2 content of initial L1+L2 capsid stocks. A purified p16L1L2 capsid preparation was subjected to two-