User Privacy Attacks through Self-Modifying Code Conflicts

Abstract

Self-modifying code (SMC) is a specialized technique that alters program execution by modifying instructions in executable memory pages during runtime. While historically employed for performance tuning, dynamic optimization, and obfuscation, both x86 and RISC-V-based processors continue to support SMC as part of their architectural flexibility. However, the same capability that enables adaptive and high-performance execution also opens the door for novel microarchitectural exploitation. In particular, SMC allows attackers to induce distinctive instruction fetch and cache behaviors, thereby enabling precise monitoring of shared microarchitectural resources such as instruction caches. In this paper, we present the first in-depth security study of SMC on the latest Intel microarchitectures, including the latest hybrid CPU designs that balance performance and energy efficiency. We systematically analyze a set of x86 instructions that directly or indirectly invalidate instruction cache lines, revealing measurable timing asymmetries between cache hits and misses. Our results show that these SMC-induced timing artifacts can be leveraged to mount high-resolution cache attacks that are both stealthier and more reliable than traditional techniques. We demonstrate the power of our approach through two privacy-violating case studies: (1) recovering victim keystrokes with high accuracy in real time, and (2) performing website fingerprinting on hyper-threaded CPU cores, successfully targeting both the Google Chrome and Tor browsers. Beyond empirical results, we explore the architectural conditions that amplify SMC side effects, discuss the broader implications for multi-tenant and browser-based environments, and give an overview of possible hardware and software-level countermeasures.