Sudoku: Refining DRAM Address Mapping Through Advanced Timing and Configuration Analysis
Minbok Wi, Wanju Doh, Seungmin Baek, Seonyong Park, Mattan Erez, Jung Ho Ahn · IEEE Access · 2026
Understanding undocumented DRAM address-mapping functions is crucial for enabling well-known attacks, such as RowHammer, and for gaining deeper insights into memory system behavior. Prior software-based reverse-engineering approaches primarily rely on access latency differences caused by row-buffer conflicts to identify functions that distinguish DRAM banks. Other works aim to decompose DRAM address mappings into component-level details, either operating only on specific CPU platforms or being limited to identifying functions up to the rank level, without revealing finer-grained DRAM components. In this paper, we propose Sudoku, a software-only tool that automatically decomposes full DRAM address mappings into channel, rank, bank group, and bank functions. Sudoku first distinguishes channel-indexing functions by exploiting bandwidth differences across DRAM address-mapping functions. It then leverages two newly identified timing channels to decompose the remaining address-mapping functions: (1) refresh-interval-induced latency variations and (2) timing constraints arising from consecutive memory accesses. Together, these techniques enable Sudoku to refine DRAM address mappings into component-level functions, allowing it to identify not only banks but also finer-grained DRAM components that were previously difficult to distinguish. We evaluate Sudoku on recent Intel and AMD processors and demonstrate that it successfully decomposes DRAM address mappings into component-level functions.