Is there another way to fully cache the target memory without using pread()?

[howardzhang87]

In your code, you use pread() to cache the linux_proc_banner. I'm wondering if there is another way to do that? You mentioned that this could work with prefetch or sched_yield. I tried to replace the pread(fd, buf, sizeof(buf), 0) with _mm_prefetch((char*)addr, 0) and it doesn't work.

Can you show me the alternative way? Thanks!

[paboldin]

It works with sched_yield. Take a look at the exploit IAIK: https://github.com/IAIK/meltdown
Here I use a modified version to read arbitrary process memory: https://www.youtube.com/watch?v=De4rBaAdKNA