Eliott Quéré

For over a decade, software-based microarchitectural attacks have mainly exploited timing differences to infer information from DRAM. However, recent timing-based approaches failed to characterize some precise microarchitectural behaviors, either due to defense or optimization mechanisms. In this work, we show that unprivileged millisecond- and milliampere-resolution power sensors on modern Arm SoCs are sufficient to recover DRAM mapping functions and reveal the data dependence of memory accesses without any timers. We present HOMARD, a new methodology that reads DRAM activity from this benign telemetry, overcoming the mentioned timing limitations. Building on this, we introduce two new attack primitives. HOMARD-RE is a hierarchy-aware linear-algebraic method that reverse-engineers the DRAM addressing functions from power alone. HOMARD-DATA recovers the Hamming weight of a fetched cache line through joint-power rail templating, and the secret byte values that the CPU moves across the DRAM bus through correlation power analysis on the same rails. Across an AMD ZCU102, a Raspberry Pi 5, and a multi-chip-based LPDDR4 NVIDIA Jetson TX2, HOMARD-RE succeeds where row-buffer timing methods fail. On the Pi 5, HOMARD-DATA classifies 9 Hamming-weight levels at 81.5% accuracy and recovers secret bytes in minutes by correlating the rail current with the data-dependent bit toggling between neighbors in a row. Both primitives work with an architectural load or a mispredicted Spectre-RSB path on which no value is architecturally read. Together, these results establish unprivileged power telemetry as an independent side channel for profiled attacks on the microarchitecture, particularly powerful when timing falls silent.

When timing reaches its limits and fails to discriminate events, the microarchitecture falls silent. Yet power does not. Power leakage from the shared distribution network becomes key to remotely exploiting new side-channel sources on modern heterogeneous SoC architectures, directly challenging the literature built around timing-centric mitigations or presumed timing-level opacity of certain modern processor microarchitecture features, such as Arm’s snoop control unit. In this work, we embed a time-to-digital converter in the programmable logic of a Zynq-7000 SoC-FPGA and show that a short, software-triggered power distribution network signature of a probed memory load from the Arm Cortex-A9 is sufficient to characterise the entire memory hierarchy (i.e., L1, L2, and DRAM) service, as well as coherence states from the snoop control unit. This reveals a new class of hybrid software-hardware vulnerabilities in which unprivileged user code, coordinated with an embedded power sensor, can record high-resolution traces from the shared power distribution network and enable fully remote, fine-grained microarchitectural observation using power leakage on heterogeneous architectures. Building on this capability, we introduce two new attack primitives: Flush+Power, a line-level resolution, same-core attack in shared-memory settings, and SnoopyPower, which reveals coherence-active cache lines across cores. Together, these results demonstrate how programmable logic can become a powerful physical threat vector to CPU microarchitectures in heterogeneous systems, revealing power consumption-based side channels that persist even when timing observation fails.

In multi-tenant FPGA-accelerated cloud platforms, independent users share the same reconfigurable fabric and underlying hardware resources. This work investigates how DRAM access patterns observable through side-channel measurements can be exploited to fingerprint FPGA-CPU environments, enabling co-location detection and infrastructure reconnaissance in reconfigurable cloud scenarios.