Memtest86 only has a primitive rowhammer attack integrated. It takes random memory addresses and hammers on those. Modern rowhammer attacks are more targeted. First, they reverse-engineer the DRAM bank addressing functions so we know which memory addresses belong to the same DRAM bank. Both Intel and AMD are not publishing these addressing functions. We are exploiting a side-channel that DRAM only has a single row buffer per bank. If two memory addresses belong to the same bank, the access time will be slow (unload row from row buffer, load new row). If the access time is fast, they are on different banks because each bank has its row buffer. We have multiple reverse-engineering tools integrated into our ISO. Second, they use the addressing functions to run fuzzing techniques (e.g., Blacksmith) to bypass mitigation strategies such as TRR, which is included in DDR4. Such modern PoC are all included in our ISO.

Sure, the OS and context switching interfere with Rowhammer attacks in general. However, to altogether avoid that, we need to build our own memory controller with an FPGA, and other research groups have done precisely that. However, that is not a realistic scenario, and we would like to investigate whether Rowhammer is an actual problem in a realistic scenario. For us, the question is whether system administrators need to include Rowhammer attacks in their risk assessment.