  As recently emerged rowhammer exploits require undocumented DRAM address
mapping, we propose a generic knowledge-assisted tool, DRAMDig, which takes
domain knowledge into consideration to efficiently and deterministically
uncover the DRAM address mappings on any Intel-based machines. We test DRAMDig
on a number of machines with different combinations of DRAM chips and
microarchitectures ranging from Intel Sandy Bridge to Coffee Lake. Comparing to
previous works, DRAMDig deterministically reverse-engineered DRAM address
mappings on all the test machines with only 7.8 minutes on average. Based on
the uncovered mappings, we perform double-sided rowhammer tests and the results
show that DRAMDig induced significantly more bit flips than previous works,
justifying the correctness of the uncovered DRAM address mappings.
