Software pipeline verifies dram address mapping on embedded systems
Verified DRAM Address Mapping Reverse Engineering with Threshold Sweep
Hardware Architecture
Summary
Memory chips called DRAM have hidden ways that computers use addresses to organize data inside them. Figuring out these hidden address patterns is important, especially for small devices, but it can be tricky. This paper introduces a step-by-step software method that collects timing data from the memory, guesses possible address groupings, and then checks these guesses carefully to find the true pattern. Their approach works well on devices with a type of DRAM called LPDDR5 and helps with understanding and fixing security issues like Rowhammer.
What this means in practice
- •For embedded system engineers: Use the software pipeline to accurately determine DRAM bank mappings on ARM-based LPDDR5 devices for better hardware analysis and security testing.
- •For security testing teams: Employ the verified address mapping method to conduct more precise Rowhammer vulnerability analysis on embedded memory systems.
Authors
Hewen Zhang, Ian G. Harris
Abstract
We propose an end-to-end software pipeline for solving and validating DRAM address mapping functions on embedded LPDDR5 systems, and we instantiate it on embedded platforms. Starting from a large latency dataset of address pairs, the pipeline first builds a latency histogram and then performs a threshold sweep to obtain candidate same-bank address pairs. For each threshold, we apply a Knock-Knock-style linear-constraint solver to recover candidate bank masks. Final bank masks are calculated using GF(2) reduced row echelon form (RREF). To verify correctness, we implement two verification stages, group verification and single function verification, inspired by prior work. Group verification checks whether bank partitions induced by the recovered masks agree with observed timing behavior. Single function verification removes one addressing function at a time and measures the resulting change in verification pass rate. Unlike approaches that return only a single inferred mapping, our workflow systematically records, for each candidate threshold, the solved bank masks and validation metrics. This pipeline supports more robust selection of bank masks on ARM-based embedded devices and provides an efficient method for reverse engineering DRAM address mapping functions and subsequent Rowhammer analysis.