How to get the host physical address of sys_call_table in a real attack? about l1tf-poc

[gregvish]

Hi, sorry for the late response.
I assume that by "offset", you mean the offset of sys_call_table from the kernel base?
My assumption in this work was that you know which kernel you're attacking (you have the binary). If you assume that the version is unknown, of course the problem becomes much harder.
However, I think this is still solvable. If you know, for example, that the host is Ubuntu (but not which kernel version), simply download all versions of the kernel-image package. Then analyze all the images to find the set of all possible sys_call_table offsets. How large will this set be? Far less than the 2^20 you're afraid of.

[xiam0nd]

Thanks very much for your great suggestion!