• Home

  • Documents

  • ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU...
137
ASLR on the Line Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, Cris �ano Giuffrida VUSec

ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

  • Upload
    others

  • View
    19

  • Download
    0

Embed Size (px)

Citation preview

Page 1: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

ASLR on the LineBen Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, Cris�ano Giuffrida

VUSec

Page 2: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Erik Bosman @brainsmoke

Page 3: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Ben Gras @bjg

Kaveh Razavi @gober

Stephan van Schaik

Page 4: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data
Page 5: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

ASLR

Page 6: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Address Space Layout Randomiza�on

Widely deployed exploit mi�ga�on strategy:

Choose a different loca�on for code and data

every �me a process is run.

Page 7: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 8: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 9: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 10: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 11: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 12: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 13: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 14: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Address Space Layout Randomiza�on

Makes life for exploit writers a bit more

difficult.

Usually exploits need to know the loca�on

of certain data in memory.

Page 15: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

A Single Leak Reveals

-- Joshua Drake

Page 16: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Address Space Layout Randomiza�on

Exploit writers need to find a bug which leaks

addresses without crashing the program.

... or do they?

Page 17: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

This Presenta�on:

A side-channel a�ack on processes bakedinto the hardware to discover ASLRinforma�on from Javascript in the browser.

ASLR Cache (AnC)⊕

Page 18: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU CoreL1

L2

L3 (Last Level Cache), shared between cores

DDR Memory

CPU CoreL1

L2

CPU CoreL1

L2

CPU CoreL1

L2

Modern CPU architectures

Page 19: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

Page 20: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

Page 21: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

Page 22: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

MMU

virtualaddress

physical address

Page 23: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

physical address

MMUTLB

cache

Page 24: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

physical address

MMUTLB

cachePT

walk

miss

Page 25: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

physical address

MMUTLB

cachePT

walk

miss

Page 26: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Timers in Javascript

Page 27: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

t0=performance.now();

operation();

t1=performance.now();t = t1-t0; m

easu

red

�m

e

real �me

Page 28: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

t0=performance.now();

operation();

t1=performance.now();t = t1-t0; m

easu

red

�m

e

real �me

Page 29: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

t0=performance.now();

operation();

t1=performance.now();t = t1-t0; m

easu

red

�m

e

real �me

a�er an�- side-channel mi�ga�ons (firefox)a�er an�- side-channel mi�ga�ons (firefox)

Page 30: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)

Page 31: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)

Page 32: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)

Page 33: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)

Page 34: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (firefox)a�er an�- side-channel mi�ga�ons (firefox)

Page 35: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c = 0;t0 = p.now();while(t0 == p.now());t1 = p.now();

operation();

while(t1 == p.now()){ c++; }

mea

sure

d �

me

real �me

a�er an�- side-channel mi�ga�ons (chrome)a�er an�- side-channel mi�ga�ons (chrome)

Page 36: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

new SharedArrayBuffer()

Page 37: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

memory which may be shared between

mul�ple worker threads.

new SharedArrayBuffer()

Page 38: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

enabled by default by Firefox, Chromeand Edge since 2017

memory which may be shared betweenmul�ple worker threads.

new SharedArrayBuffer()

Page 39: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

let SharedRowhammerBuffer = SharedArrayBuffer;

Page 40: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 41: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 42: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 43: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 44: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 45: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 46: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

c=0;while (buf[0] == 0);

while (buf[0] == 1){ c++; }

buf[0]=1;operation();buf[0]=0;

1

2 mea

sure

d �

me

real �me

using SharedArrayBuffer and worker threads

Page 47: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Cache Side-Channels

Page 48: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

cache line (64 bytes)

memory

memory access

data physical address

Page 49: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

N-way associa�vecache set

1 cache set

memory

memory access

data physical address

Page 50: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...2048 cache sets with 64 byte cache lines

memory

memory access

data physical address

Page 51: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...

as many slices as cores

...

...

...memory

memory access

data physical address

Page 52: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...

memory

memory access

data physical address

Page 53: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...cache_set = (addr >> 6) % 2048,

direct mapping,repeated every 128KB

memory

memory access

data physical address

Page 54: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

...cache_set = (addr >> 6) % 2048,

cache_slice = xor_hash(addr)

direct mapping,

repeated every 128KB

memory

memory access

data physical address

Page 55: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

cache_set = (addr >> 6) % 2048,direct mapping,

repeated every 128KB

memory

memory access

data physical address

Page 56: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

cache_set = (addr >> 6) % 2048,

two cache lines mapping to the same cache sethave the same physical address modulo 128KB

direct mapping,repeated every 128KB

memory

memory access

data physical address

Page 57: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

cache_set = (addr >> 6) % 2048,

two cache lines mapping to the same cache sethave the same physical address modulo 4KB

direct mapping,repeated every 128KB

memory

memory access

data physical address

Page 58: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cache

two cache linesmapping to thesame cache sethave the sameoffset into theirmemory page

memory

memory access

data physical address

1 page =64 cache lines

Page 59: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Page 60: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

evict(line_x);time();t0 = time();operation();t = time()-t0;

Page 61: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

evict(line_x);time();t0 = time();operation();t = time()-t0;

Page 62: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Xmybuf

X

X

X

...

evict(line_x);time();t0 = time();operation();t = time()-t0;

Page 63: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Xmybuf

X

X

X

...

evict(line_x);time();t0 = time();operation();t = time()-t0;X X X X X X X X X X X X

...

Page 64: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Xmybuf

X

X

X

...

evict(line_x);time();t0 = time();operation();t = time()-t0;X X X X X X X X X X X X

...

Page 65: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

L3 cacheEVICT + TIME

(does an opera�on use a specific cache line?)

Xmybuf

X

X

X

...

evict(line_x);time();t0 = time();operation();t = time()-t0;X X X X X X X X X X X X

...

trigger memory access (or not)

Page 66: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Core

L1 code / L1 data

L2

L3 (Last Level Cache), shared between cores ......

memory access

data

virtualaddress

physical address

MMUTLB

cachePT

walk

miss

Page 67: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Page Tables

Page 68: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

lower addresses

higher addresses

0

248-1

Page 69: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

512 entriescovering512GB each

0

248-1

Page 70: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3512 entriescovering1GB each

0

248-1

Page 71: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3512 entriescovering2MB each

0

248-1

Page 72: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

512 entriespoin�ngto 4096 byteregions inmemory 0

248-1

Page 73: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

0

248-1

Page 74: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

7F83B6372040virtual address lookup (x86_64)

Page 75: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

7F83B6372040virtual address lookup (x86_64)

7 F 8 3 B 6 3 7 3 0 4 0

Page 76: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

TLB miss!

Page 77: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

Page 78: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

512entries

0

511

Page 79: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

512entries

0

511

Page 80: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

512entries

Page 81: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14

512entries

Page 82: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14

512entries

Page 83: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433

512entries

Page 84: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433

512entries

Page 85: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

512entries

Page 86: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

actualdata

Page 87: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

actualdata

64

Page 88: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

actualdata

4K page

64

Page 89: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

Page 90: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

Page 91: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

address informa�on is directly encoded

into the page table lookups, and pagetables are pages themselves.

Observa�on:

Page 92: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

Page 93: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

4K page 4K page4K page 4K page

Page 94: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

255

CR3

14 433 370

4K page

64

4K page 4K page4K page 4K page

Page 95: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CR3

Page 96: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

255254253252251

250249248

256

247

255

Page 97: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

?

......

255254253252251

250249248

256

247

255

1 Cache line =64 bytes =8 possible page table entries

Page 98: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

?

......

255254253252251

250249248

256

247

255

1 Cache line =64 bytes =8 possible page table entries

Page 99: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

?

......

255254253252251

250249248

256

247

255

1 Cache line =64 bytes =8 possible page table entries

cache line reveals 6 address bits

Page 100: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

Page 101: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

Page 102: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

loca�on withinthe page known

by studyingbrowser

memory allocator

Page 103: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

Page 104: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

6437043314255

max entropy le�:

Page 105: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

max entropy le�:

Page 106: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

max entropy le�: 4*3 bits + ...

Page 107: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

which hit belongs to which cache line?

max entropy le�: 4*3 bits + ...

Page 108: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

which hit belongs to which cache line?

max entropy le�: 4*3 bits + log2( 4 * 3 * 2 * 1 )

Page 109: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ? ? ?

which hit belongs to which cache line?

max entropy le�: ~ 16.6 bits

Page 110: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

allocate a buffer

perform this side-channel a�ack on bufferentries 4096 bytes apart

measure when the page table lookupcrosses a cache line boundary

Sliding

Page 111: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

370

Page 112: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

371

+4096 bytes

Page 113: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

372

+4096 bytes+4096 bytes

Page 114: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

373

+4096 bytes+4096 bytes

+4096 bytes

Page 115: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

374

+4096 bytes+4096 bytes

+4096 bytes

+4096 bytes

Page 116: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

375374373372371

370369368

376

367

375

+4096 bytes+4096 bytes

+4096 bytes

+4096 bytes

+4096 bytes

Page 117: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

376

+4096 bytes+4096 bytes

+4096 bytes

+4096 bytes

+4096 bytes+4096 bytes

......

375374373372371

370369368367

376

Page 118: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

we can do the same thing for the 2ndlevel page table

Sliding

Page 119: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

433

Page 120: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

434

+2MB

Page 121: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

435

+2MB

+2MB

Page 122: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

436

+2MB+2MB+2MB

Page 123: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

437

+2MB+2MB+2MB+2MB

Page 124: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

438

+2MB+2MB+2MB+2MB+2MB

Page 125: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

439

+2MB+2MB+2MB+2MB+2MB+2MB

Page 126: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

439438437436435

434433432

440

431

440

+2MB+2MB+2MB+2MB+2MB+2MB

+2MB

Page 127: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ?

Page 128: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ?

Page 129: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

? ?

max entropy le�: 2*3 + log2(2 * 1) = 7 bits

Page 130: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

1514131211

1098

16

7

+1GB

14

Page 131: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

......

255254253252251

250249248

256

247

255

+512GB

Page 132: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Firefox (on Linux) does not ini�alizeArrayBuffers, so linux does not allocatespace for the actual pages

We can allocate huge chunks and usesliding to recover the whole address

Alloca�ng large chunks of memory

Page 133: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Chrome does ini�alize memory, butjumps ahead in the address space every�me it creates a new heap

3rd level address bits can be recovered,4'th level bits needs chrome toini�alize/free up to 4TB :-)

Alloca�ng large chunks of memory

Page 134: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

CPU Model Microarchitecture Year

Intel Xeon E3-1240 v5 Skylake 2015

Intel Core i7-6700K Skylake 2015

Intel Celeron N2840 Silvermont 2014

Intel Xeon E5-2658 v2 Ivy Bridge EP 2013

Intel Atom C2750 Silvermont 2013

Intel Core i7-4500U Haswell 2013

Intel Core i7-3632QM Ivy Bridge 2012

Intel Core i7-2620QM Sandy Bridge 2011

Intel Core i5 M480 Westmere 2010

Intel Core i7 920 Nehalem 2008

AMD FX-8350 8-Core Piledriver 2012

AMD FX-8320 8-Core Piledriver 2012

AMD FX-8120 8-Core Bulldozer 2011

AMD Athlon II 640 X4 K10 2010

AMD E-350 Bobcat 2010

AMD Phenom 9550 4-Core K10 2008

Allwinner A64 ARM Cortex A53 2016

Samsung Exynos 5800 ARM Cortex A15 2014

Samsung Exynos 5800 ARM Cortex A7 2014

Nvidia Tegra K1 CD580M-A1 ARM Cortex A15 2014

Nvidia Tegra K1 CD570M-A1 ARM Cortex A15; LPAE 2014

This side-channelwas detected on22 out of 22 testedarchitectures!

Page 135: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Demo video

Page 136: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Conclusions

- Browser vendors seem to have given up on protec�ng against side-channel a�acks in favor of adding features :,-(

- It's possible to perform cache side-channel a�acks from Javascript on the Memory Managment Unit to recover ASLR informa�on

Page 137: ASLR on the Line · L1 L2 L3 (Last Level Cache), shared between cores DDR Memory CPU Core L1 L2 CPU Core L1 L2 CPU Core L1 L2 Modern CPU architectures. CPU Core L1 code / L1 data

Any Ques�ons?

VUSecproject page:h�ps://vusec.net/projects/anc


3-Phase Power Distribution Unit · L1-L2 L2-L 3 L3-L1 L1-L2 L2-L3 L3-L1 A B B B C C C I H J. 5 Product Features: Switched Metered by Outlet/Switched (16/20A Models) Technical Specifications

3-Phase Power Distribution Unit · L1-L2 L2-L 3 L3-L1 L1-L2 L2-L3 L3-L1 A B B B C C C I H J. 5 Product Features: Switched Metered by Outlet/Switched (16/20A Models) Technical Specifications

Documents
LA Comparing L1 and L2 acquisition - uni-jena.dex4diho/LA_Comparing L1... · Schedule Comparing L1 and L2 acquisition The role of the native language in L2 acquisition The critical

LA Comparing L1 and L2 acquisition - uni-jena.dex4diho/LA_Comparing L1... · Schedule Comparing L1 and L2 acquisition The role of the native language in L2 acquisition The critical

Documents
ACFI2001 L1 L2

ACFI2001 L1 L2

Documents
Static Toolholders DIN 69880 - eyar.co.il Toolholders Catalog.pdf · Toolholders DIN 69880. 24 25 l1 l2 d4 d3 d1 l1 d1 l2 d4 d2 l1 l2 d4 d3 d1 l1 d1 l2 d4 d2 l1 l2 d4 d3 d1 l1 d1

Static Toolholders DIN 69880 - eyar.co.il Toolholders Catalog.pdf · Toolholders DIN 69880. 24 25 l1 l2 d4 d3 d1 l1 d1 l2 d4 d2 l1 l2 d4 d3 d1 l1 d1 l2 d4 d2 l1 l2 d4 d3 d1 l1 d1

Documents
Programme de formation L1,L2

Programme de formation L1,L2

Documents
L2 & L1

L2 & L1

Documents
L1, L2- Introduction

L1, L2- Introduction

Documents
BIDIRECTIONAL CROSSLINGUISTIC INFLUENCE IN L1-L2 …

BIDIRECTIONAL CROSSLINGUISTIC INFLUENCE IN L1-L2 …

Documents
L1 & l2

L1 & l2

Documents
Tools for Computational Physics Week 2, Lecture 2 ... · The basic CPU structure Interface Bus Processor L1 Cache L2 Cache Processor/Memory Bus •A CPU contains a chip where circuits

Tools for Computational Physics Week 2, Lecture 2 ... · The basic CPU structure Interface Bus Processor L1 Cache L2 Cache Processor/Memory Bus •A CPU contains a chip where circuits

Documents
ocw.mit.edu · l1 l2 l1 < l2 l1, l2 = number of data. Title: 02-head.dvi

ocw.mit.edu · l1 l2 l1 < l2 l1, l2 = number of data. Title: 02-head.dvi

Documents
CVEN 345 Quiz B Problem 1 L1 L2 R1 P R2 L1 L2...L1 L2 L3 L1 L2 L3 m2=1*L3 m1=1*L3 m1=1*L3 m3=1*(L1+L2) M0 M1 = - P*L1 L1 L2 L3 m4=1*L2 P DeltaLittle11 = Integral(m1*m1*dx)/EI Volume

CVEN 345 Quiz B Problem 1 L1 L2 R1 P R2 L1 L2...L1 L2 L3 L1 L2 L3 m2=1*L3 m1=1*L3 m1=1*L3 m3=1*(L1+L2) M0 M1 = - P*L1 L1 L2 L3 m4=1*L2 P DeltaLittle11 = Integral(m1*m1*dx)/EI Volume

Documents
Cpu Cacheline False Sharing - lrita.github.io · 5 Jiri Olsa, Joe Mario Resolving a memory access – more expensive case. CPU4 CPU5 CPU6 CPU7 L1 L1 L1 L1 L2 L2 L2 Memory (foo’s

Cpu Cacheline False Sharing - lrita.github.io · 5 Jiri Olsa, Joe Mario Resolving a memory access – more expensive case. CPU4 CPU5 CPU6 CPU7 L1 L1 L1 L1 L2 L2 L2 Memory (foo’s

Documents
Effects of L1 orthography and L1 phonology on L2 …centaur.reading.ac.uk/77792/1/Mairano_Bassetti_Sokolovic...Effects of L1 orthography and L1 phonology on L2 English pronunciation

Effects of L1 orthography and L1 phonology on L2 …centaur.reading.ac.uk/77792/1/Mairano_Bassetti_Sokolovic...Effects of L1 orthography and L1 phonology on L2 English pronunciation

Documents
Pshycholinguistic L1 and L2 Acquistion

Pshycholinguistic L1 and L2 Acquistion

Education
Wilo-Yonos PARA High Flow...NOTE: Make sure that 230 V is applied between the phases (L1-L2, L1-L3 or L2-L3). Two phases (L1-L2, L1-L3 or L2-L3) are to be applied at the ter minals

Wilo-Yonos PARA High Flow...NOTE: Make sure that 230 V is applied between the phases (L1-L2, L1-L3 or L2-L3). Two phases (L1-L2, L1-L3 or L2-L3) are to be applied at the ter minals

Documents
Neat L1 L2 L1 L2 1:21:41:8 dilution Coomassie SYPRO L2 content of initial L1+L2 capsid stocks. A purified p16L1L2 capsid preparation was subjected to two-

Neat L1 L2 L1 L2 1:21:41:8 dilution Coomassie SYPRO L2 content of initial L1+L2 capsid stocks. A purified p16L1L2 capsid preparation was subjected to two-

Documents
Hello from the Other Side: SSH over Robust Cache …...hash function maps a physical address to a slice 4/25 Caches on Intel CPUs core0 L1 L2 core1 L1 L2 core2 L1 L2 core3 L1 L2 ring

Hello from the Other Side: SSH over Robust Cache …...hash function maps a physical address to a slice 4/25 Caches on Intel CPUs core0 L1 L2 core1 L1 L2 core2 L1 L2 core3 L1 L2 ring

Documents
Vit a,d l1, l2

Vit a,d l1, l2

Health & Medicine
Bilingualisam L1 and L2

Bilingualisam L1 and L2

Education
Contents · Contents Introduction ... Trimble NetR5 GPS L1 C/A Code, L2C, L1/L2/L51 Full Cycle Carrier, GLONASS L1 C/A Code, L1 P Code, L2 P Code, L1/L2 Full Cycle Carrier with

Contents · Contents Introduction ... Trimble NetR5 GPS L1 C/A Code, L2C, L1/L2/L51 Full Cycle Carrier, GLONASS L1 C/A Code, L1 P Code, L2 P Code, L1/L2 Full Cycle Carrier with

Documents
L2 L1 Freedom 66 - SCS Concept

L2 L1 Freedom 66 - SCS Concept

Documents
12-L1-L2-Pumps etc.ppt

12-L1-L2-Pumps etc.ppt

Documents
10 L1 L2 Heat Exchange

10 L1 L2 Heat Exchange

Documents
L1-N / L1-L2 L2-N / L2-L3 L3-N / L3-L1 - file.yizimg.comfile.yizimg.com/313301/2012080722284624.pdf · Page 10 Strommessung/Current Measurement k l L1 L2 L3 k l k l 57 106 89 Spannungsmessung

L1-N / L1-L2 L2-N / L2-L3 L3-N / L3-L1 - file.yizimg.comfile.yizimg.com/313301/2012080722284624.pdf · Page 10 Strommessung/Current Measurement k l L1 L2 L3 k l k l 57 106 89 Spannungsmessung

Documents
Pshycholinguistic - L1 and L2 Acquisition

Pshycholinguistic - L1 and L2 Acquisition

Education
A63 L1&L2 Service Manual.pdf

A63 L1&L2 Service Manual.pdf

Documents
WECHSEL- VERKEHRS- ZEICHEN- ANLAGE 3 Anlage F2... · Citroen Jumper L1, L2, L4, L5 H1, H2, H3 Citroen Jumpy L1, L2 H1, H2 Fiat Ducato L1, L2, L4, L5 H1, H2 Fiat Scudo L1, L2 H1 Ford

WECHSEL- VERKEHRS- ZEICHEN- ANLAGE 3 Anlage F2... · Citroen Jumper L1, L2, L4, L5 H1, H2, H3 Citroen Jumpy L1, L2 H1, H2 Fiat Ducato L1, L2, L4, L5 H1, H2 Fiat Scudo L1, L2 H1 Ford

Documents
developmental dynamics in L1 and L2 acquisition · comparison of development in L1 and L2 acquisition. Proponents of the Fundamental Difference Hypothesis (between L1 and L2) assume

developmental dynamics in L1 and L2 acquisition · comparison of development in L1 and L2 acquisition. Proponents of the Fundamental Difference Hypothesis (between L1 and L2) assume

Documents
Differences between-l1-and-l2-speaking

Differences between-l1-and-l2-speaking

Education