Slide 29
Slide 29 text
if (index is in bounds) {
let secretByte = array1[index];
g_dontCare = array2[secretByte];
}
whatever,
just assume it’s in bounds.
go go go!
For example, do a second memory access, for a location that depends on this secret data. So if the byte you’ve read is, I dunno, 65, the next thing you do is look up
element number 65 in a separate array, one that you created. I know, this looks super pointless. But this is what it looks like when you’re trying to smuggle information
from one timeline to another, OK? Here’s why this works. The CPU caches every piece of memory it touches, for speed, so when you do this, the CPU grabs element
number 65 out of “array2”, and that gets cached.