Reverse Engineering of DRAMs: Row Hammer with Crosshair

Abstract

In this paper we present a technique that reconstructs the physical location of memory cells in a Dynamic Random Access Memory (DRAM) without opening the device package and microscoping the device. Our method consists of an retention error analysis while a temperature gradient is applied to the DRAM device. This enables the extraction of the exact neighborhood relation of each single DRAM cell, which can be used to accomplish Row Hammer attacks in a very targeted way. However, this information can also be used to enhance current DRAM retention error models.