Viewing profile — jprx

Haven't gotten around to it yet haha

Hi everyone, Joseph (paper author) here. You can find Fractal on Github: https://github.com/jprx/fractal The full paper, slides from my S&P talk, and all our experiment data can be…

You can find PDFs of the lectures as well as the reading list here: https://shd.mit.edu/2025/calendar.html https://shd.mit.edu/2025/lectureReadings.html

Personally, I learned programming when I was a kid by watching YouTube tutorials + reading random Internet sources. When helping build SHD, it was important to me that we "paid it …

We teach using Intel X86_64 CPUs for a variety of reasons - Most academic research has been done on Intel systems, so it's easier for students reading papers to relate to their exp…

Yes! Our labs include building your own real spectre attack against the kernel, bypassing ASLR and building ROP chains with various side channels, finding and exploiting backdoors …

You get it!!

Unwinding changes to the TLB on every mispredict would have a significant overhead and hurt overall performance. Removing valid data you just cached (speculatively or otherwise) is…

Additionally, if can find a way to trick a user into installing a malicious kext, why even bother with PACMAN? You already have arbitrary kernel code execution!

You could maybe do it with lots of fences or just a ridiculous chain of NOPs after each branch such that the ROB is cleared before you have time to try to load a pointer speculativ…

Pretty much! (There are a few aspects that make this challenging in practice, but that's the idea).

ILL-INI!!! 1) Our attack does apply a brute force technique with the twist that crashes are suppressed via speculative execution. If you tried to brute force a PAC against the kern…

This is a great question! What this means is that a software patch cannot fix the speculative execution behavior that causes the PACMAN issue since it is built directly into how th…

You can think of it a lot like that! PAC is more advanced as you can describe what a pointer "should" do on access (aka is this a data or code pointer?).

Hi! This is an interesting idea. However, there is a problem that arises- if you rotate the key, then old pointers now become invalid. And since the kernel is always alive and serv…

Hi! I think I can clear a few things up here. Our goal is to demonstrate that we can learn the PAC for a kernel pointer from userspace. Just demonstrating that this is even possibl…

You hit the nail right on the head! That's exactly what we did :)

Hi! Joseph (one of the authors) here. You can read more about our attack here: https://pacmanattack.com

Hi! Joseph (one of the authors) here. The PDF is available here: https://pacmanattack.com/paper.pdf