Hamming-weight accuracy
Classifies nine Hamming-weight levels on Raspberry Pi 5. Hamming weight is the number of bits set to one.
IEEE Security & Privacy 2027
HOMARD
Hammering Off-chip Memory via Aggregate power Rail Disclosure
HOMARD leaks data moving through DRAM using onboard power sensors. We introduce two primitives: HOMARD-DATA to recover data, and HOMARD-RE to recover memory mappings. All from software.
> Main contribution
HOMARD-DATA
Recover secret data from DRAM power.
Power consumption depends on the values transferred from memory. HOMARD-DATA lets us recover the number of set bits in a memory block and leak secret byte values using software-accessible power measurements.
Recovered in minutes
Recovers secret byte values from DRAM power measurements on Raspberry Pi 5 in our evaluation.
Speculative loads leak too
Demonstrated with architectural loads and a Spectre-RSB path, where the value is not architecturally read.
Results depend on the platform and the profiling and access assumptions described in the paper.
> Second primitive
HOMARD-RE
Recover the memory mapping.
HOMARD-RE recovers DRAM addressing functions from power measurements. It reveals how addresses map to the memory hierarchy, including on the Jetson TX2 where row-buffer timing methods fail.
AMD ZCU102Raspberry Pi 5NVIDIA Jetson TX2
> Paper & code
Read. Cite. Explore.
HOMARD: Hammering Off-chip Memory via Aggregate power Rail Disclosure
To appear at the IEEE Symposium on Security and Privacy, 2027.
01 / Paper
Read the research.
The preprint is publicly available on HAL.
hal-05787490 Read the preprint ↗02 / Code
Explore the code.
The HOMARD code is publicly available on GitHub.
Koyiott/homard View on GitHub ↗> FAQ
Questions & answers
Which systems did you evaluate?
AMD ZCU102, Raspberry Pi 5, and NVIDIA Jetson TX2. The demonstrated results depend on the platform, sensor access, and experimental conditions. They do not establish that every Arm device is affected.
Does HOMARD need physical access?
The demonstrated measurement path uses onboard power sensors accessible from software. No external probe is needed. The paper details the access and profiling assumptions for each experiment.
What can reduce the risk?
Restricting unprivileged access to power-management telemetry removes the demonstrated unprivileged software measurement path. It does not eliminate the underlying physical leakage or protect against every privileged adversary.
Why HOMARD?
HOMARD stands for Hammering Off-chip Memory via Aggregate power Rail Disclosure. “Homard” is also French for lobster.
Can I use the logo?
The HOMARD logo is free to use, with rights waived via CC0. Logo designed by Eliott Quéré.
> The crew
Who is behind HOMARD?
- CentraleSupélec, Univ. Rennes, Inria, CNRS, IRISA
- Graz University of Technology
- Univ. Bretagne-Sud, Lab-STICC, UMR 6285
- Univ. Lyon, UJM-Saint-Étienne, CNRS, Lab. Hubert Curien, UMR 5516
> BibTeX
Cite HOMARD.
Preliminary citation. Publication details will be updated when available.
BibTeX
@inproceedings{quere2027homard,
title = {{HOMARD}: Hammering Off-chip Memory via
Aggregate power Rail Disclosure},
author = {Quéré, Eliott and Chiang, Li-Chung and
Fiedler, Carina and Rokicki, Thomas and
Méndez Real, Maria and Palumbo, Alessandro and
Bossuet, Lilian and Salvador, Rubén and
Gruss, Daniel},
booktitle = {2027 IEEE Symposium on Security and Privacy (SP)},
year = {2027},
note = {To appear},
url = {https://hal.science/hal-05787490}
}Acknowledgments
This research is supported in part by the ANR within the framework of the PIA EUR CyberSchool project (ANR-18-EURE-0004) and the European Research Council (ERC project FSSec 101076409). Additional funding was provided by generous gifts from Intel. Any opinions, findings, and conclusions or recommendations expressed in this paper are those of the authors and do not necessarily reflect the views of the funding parties.