BEGIN:VCALENDAR
VERSION:2.0
PRODID:Linklings LLC
BEGIN:VTIMEZONE
TZID:America/Los_Angeles
X-LIC-LOCATION:America/Los_Angeles
BEGIN:DAYLIGHT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
TZNAME:PDT
DTSTART:19700308T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
TZNAME:PST
DTSTART:19701101T020000
RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DTSTAMP:20260730T152640Z
LOCATION:
DTSTART;TZID=America/Los_Angeles:20260728T174400
DTEND;TZID=America/Los_Angeles:20260728T174400
UID:dac_DAC 2026_sess317_RESEARCH1037@linklings.com
SUMMARY:Seeing the Unseen: Reverse Engineering Hidden PMU Events by Differ
 ential Analysis and Simulation Validation
DESCRIPTION:Yihao Yang (Key Laboratory of System Software (Chinese Academy
  of Sciences) and State Key Laboratory of Computer Science, Institute of S
 oftware, Chinese Academy of Sciences); Pengfei Qiu (BUPT); Xiaojie Zhang, 
 Yihao Deng, and Chunlu Wang (Key Laboratory of System Software (Chinese Ac
 ademy of Sciences) and State Key Laboratory of Computer Science, Institute
  of Software, Chinese Academy of Sciences); Gang Qu (Univ. of Maryland, Co
 llege Park); and Dongsheng Wang (Tsinghua University & Zhongguancun Labora
 tory)\n\nThe Performance Monitoring Unit (PMU) is a significant hardware m
 odule of modern processors. Previous studies have disclosed numerous hidde
 n PMU events. However, their underlying microarchitectural semantics remai
 n unexplored, which largely limits their utilization.\n\nThis paper propos
 es a reverse engineering framework for deeply understanding the microarchi
 tectural semantics of hidden PMU events. For demonstration, we successfull
 y utilize the framework to reveal microarchitectural behaviors of branch-r
 elated events and discover a hidden pattern of UMask Combination in Intel 
 CPUs. Based on the reverse-engineering results, we implement a PMU-based c
 overt channel for Spectre-v1 in SGX and enable a high-precision website fi
 ngerprinting attack under resource-constrained conditions.\n\nTrack: EDA7-
 II. Physical Design and Verification, Design\n\nSession Chairs: Christian 
 Pilato (Politecnico di Milano); Mohsen Imani (University of California, Ir
 vine); Flavio Ponzina (San Diego State University); Amin Farshidi (Cadence
  Design Systems, Inc.); Yonggan Fu (Georgia Institute of Technology, NVIDI
 A); Dimitrios Tsaras (Huawei, Hong Kong University of Science and Technolo
 gy (HKUST)); Anh Nguyen (Fujitsu Limited); Ruiyang Qin (Villanova Universi
 ty); Jiliang Zhang (Hunan University); Meng Li (Peking University); and Ra
 ssul Bairamkulov (Advanced Micro Devices (AMD))\n\n
END:VEVENT
END:VCALENDAR