TEApot(Transient Execution Attack pot) is a project used to evaluate whether your system is affected by Meltdown and Spectre. My goal is to build a easy-to-use(hard to implement) and configurable transient attack test suite.

This project is mainly based on project Transient Fail developed by IAIK. More information will be found on their paper A Systematic Evaluation of Transient Execution Attacks and Defenses.

Linux with gcc and other dependent libraries.

Developed on 5.4.0-47-generic #51~18.04.1-Ubuntu.

x86 and arm64 are supported.

Meltdown-like and Spectre-like vulnerabilities, more information will be also found on paper A Systematic Evaluation of Transient Execution Attacks and Defenses.

This vulnerablities are supported:

This test suite allows you to select the vulnerabilities with option "-v".

Default option is "all" for testing all vulnerabilities.

You can enable and specify a markdown file as output of valid PoCs with option "-o"

You can show simple supported vulnerablities options with option "-s"

You can use option "-m" in test mode, simple result output will be available.

0 means vulnerable, 1 means not vulnerable, other values mean error or not tested.

You can use option "-h" to show all help messages or read the last part of this document.

• lib: Global libraries;
• libcache: Cache operation libraries;
• libpte: PTEditor developed by Michael Schwarz that allows manipulation of paging structures via a Linux kernel module;
• meltdown: PoC of Meltdown-like vulnerabilities;
• spectre: PoC of Spectre-like vulnerabilities;
• Makefile: Makefile of this test suite;
• run.sh: Main entry of this test suite;
• README.md: The file you are reading!

0. Some preparation

sudo apt-get install libelf-dev build-essential pkg-config bison flex libssl-dev libelf-dev bc
sudo apt-get purge libc6-dev
sudo apt-get install libc6-dev
sudo apt-get install libc6-dev-i386
sudo apt-get install build-essential
sudo apt-get install seccomp
sudo apt-get install libseccomp-dev
sudo apt-get install zsh

1. Clone this repository

git clone https://github.com/Mashiro1995/TEApot.git

2. Make

make

3. Grant execution permissions and run!

chmod +x run.sh
./run.sh
# notice that you need input your password for kernel operation during this test

4. Run options

Test mode                    :  run.sh [-options]
Generation mode              :  run.sh [-options] -g [output-path]
Test all vulnerablities      :  run.sh [-o filename] [-m]
Test specific vulnerablities :  run.sh [-v "list of vulnerablities"] [-o filename] [-m]
Show usage :                    run.sh -h
Show supported vulnerablities:  run.sh -l [-m]

Auto mode will test all vulnerablities covered in this test suite.
In manual mode, you can specify vulnerablities to be tested with options -v and followed by a list of vulnerablities.

-g              generation mode, specific path to save specific PoCs
-o              enable and specify a markdown file as output of valid PoCs
-v              list of vulnerablities to be tested. If not specified, all vuls will be test
-h              show usage
-l              show supported vulnerablities
-s              show simple supported vulnerablities options
-t              specific timeout time, default 120s
-m              used in test mode, simple result output will be available. 
                0 means vulnerable, 1 means not vulnerable, other values mean error or not tested.

You can select combination of vulnerabilities with following inputs:

You can also use multi_parameters to select specific vulnerabilities and separate them with spaces:

Examples:

# Examples:
run.sh
    # Test all vulnerabilities.
run.sh -m
    # Test all vulnerabilities and save simple result to result.txt.
run.sh -v "meltdown spectre_btb" -o codes
    # Test all Meltdown and all Spectre_BTB type vulnerabilities, and save successful PoCs to path "codes".
run.sh -v "meltdown spectre_btb" -o codes -m
    # Test all Meltdown and all Spectre_BTB type vulnerabilities, save simple result to result.txt, and successful PoCs to path "codes".
run.sh -v "meltdown spectre_btb" -g codes
    # PoCs of Meltdown and all Spectre_BTB type vulnerabilities will be saved to path "codes" with out test.