Artifact — iEnFlow: Endogenous Control-Flow Attacks via Conditional Branch Prediction on Apple Silicon

This codebase is the artifact for the paper iEnFlow: Endogenous Control-Flow Attacks via Conditional Branch Prediction on Apple Silicon. It reverse-engineers the CBP (Conditional Branch Predictor) PHR and PHT design on Apple Silicon M1–M4, breaks KASLR on the latest macOS (26.2, at the time of writing), and implements an out-of-place Spectre-PHT attack. The artifact consists of three parts: CBP reverse engineering, the KASLR break attack, and the out-of-place Spectre-PHT proof-of-concept. The CBP reverse engineering framework can also be reused for other microarchitectural analysis experiments on Apple Silicon.

Safety Warning

This artifact involves the following risky operations:

• Sudo execution: CBP reverse-engineering experiments require sudo to access Apple KPC (Kernel Performance Counters). The KASLR break and Spectre experiments require sudo to load kernel extensions.
• SIP disabled: Loading kernel extensions requires SIP (System Integrity Protection) to be disabled, which reduces system security.
• Kernel code injection: Loading kexts installs custom code into the kernel. The potential risk of this code is unknown.

Prerequisites

Requirement	Detail
Hardware	Apple Silicon Mac (M1/M2/M3/M4). Must match the model you intend to test.
OS	macOS Tahoe 26.2 (buildVersion 25C56). The OS version affects kernel address configuration and experimental results for the KASLR break. While we have not fully tested other versions, we believe the attack should generalize to them.
Python 3	With numpy, matplotlib (required for CBP heatmap plotting).
Xcode	Required for building kernel extensions.
Disk space	~100 MB.

Directory Structure

.
├── cbp-re/                   # CBP reverse engineering (Section 3)
│   ├── *.cc / run_*.py       #   Six experiments (phrb, phrt, pc, assoc, index, tag)
│   ├── shared.h / shared.py  #   Shared C++/Python utilities
│   ├── Makefile / run.sh     #   Build & orchestration
│   └── README.md
├── kaslr/                    # KASLR break (Section 5)
│   ├── 1_readphr.cc          #   Phase 1: leak PHR values
│   ├── 2_diff_analysis.py    #   Phase 2: differential analysis
│   ├── 3_pht_collision.cc    #   Phase 3: PHT collision
│   ├── search.py             #   Offline simulation
│   ├── test_accuracy.sh      #   Accuracy benchmark
│   ├── analyze_accuracy.py   #   Accuracy analysis
│   ├── config/               #   Per-platform config headers
│   ├── common/               #   Shared PHR simulator
│   ├── Makefile / run.sh     #   Build & orchestration
│   └── README.md
├── spectre/                  # Spectre-PHT attack (Section 6)
│   ├── attacker.cc           #   Unified attacker source
│   ├── config/               #   Per-platform hardware parameter headers
│   ├── Makefile / run.sh     #   Build (make MODEL=m4 CORE=p) & run
│   ├── test_accuracy.sh      #   Accuracy benchmark
│   └── README.md
├── kext/                     # Kernel extensions
│   ├── spectre/              #   Spectre-PHT gadget (kern.spectre.gadget / .info)
│   ├── slide_kext/           #   KASLR slide retrieval (kern.kaslr_slide)
│   └── README.md
├── include/                  # libae shared headers
├── src/                      # libae shared sources
├── run.sh                    # Top-level end-to-end pipeline
└── README.md                 # This file

Build and Run

Follow the per-component guides in order: cbp-re/README.md, kaslr/README.md, spectre/README.md.

Verifying Results

Follow the Verifying Results sections in cbp-re/README.md, kaslr/README.md, and spectre/README.md respectively.

---

Research paper

For more detailed research on iEnFlow, please refer to the paper iEnFlow: Endogenous Control-Flow Attacks via Conditional Branch Prediction on Apple Silicon, which has been accepted to the Proceedings of ACM Conference on Computer and Communications Security (CCS) 2026.

License

This project is licensed under the terms of the Apache License 2.0.

Disclaimer

This code is provided for academic research purposes only. The Spectre-PHT attack and KASLR break techniques demonstrated herein exploit hardware vulnerabilities that should not be used against systems without explicit authorization from the system owner. The authors bear no responsibility for any misuse or damage caused by this code.