DRAMA++: A fast and robust DRAM address-map reverse-engineering tool

This code is based on DRAMA and includes the following improvements:

• Added support for the ARM64 architecture.
• Implemented a faster GF(2) solver with polynomial-time complexity (the original version has exponential-time complexity).
• Fixed a logical bug that prevented high-order physical address bits from being considered.
• Fixed a logical bug that left the base address in the address pool when it should have been added to the set.
• Improved timing measurements.
• Additional changes for improved functionality, usability, reliability, and portability.

To see all changes, run:

git diff c5c83471...HEAD re/measure.cpp

Usage

Prerequisites

• Linux (x86-64 or ARM64) with a recent kernel.
• g++ and make installed.
• Permission to read /proc/self/pagemap (often requires sudo).
• The tool attempts huge pages first and falls back to regular pages if unavailable.

Build

cd re
make

This produces the measure binary in re/.

Run

Measure DRAM bank functions and save them to map.txt:

./measure [-b <start bit>] [-e <end bit>] [-c <cpu core>] [-r <scale factor>] [-m <memory size>] [-g <memory size in GB>] [-i <outer loops>] [-j <inner loops>] [-s <expected sets>] [-q <sets for early quit>] [-t <threshold cycles>] [-v <verbosity>] [-f <output file>]

Notes:

• -s: expected sets = DIMMs × ranks × banks (e.g., 1×2×8 = 16).
• -m/-g: memory to map. -m accepts MB by default and also supports M/G suffixes (e.g., -m 1024, -m 1G).
• -c: pin to a CPU core (you can also use taskset).
• -r: timing scale factor (advanced tuning).
• -i/-j: outer/inner loop counts; ARM64 may benefit from a higher -j.
• -t: timing threshold (cycles) to override auto gap detection.
• -b/-e: search bit window (defaults: 5..40).
• -q: stop after N sets are found.
• -v: verbosity level.
• -f: output file for discovered functions (default map.txt).

Outputs

• setN.txt: physical addresses of each discovered same-bank set.
• map.txt: one line per XOR function with the physical address bit indices.

Example

1 DIMM, 1 channel, 2 ranks, 8 banks (16 sets), mapping 1 GB:

sudo ./measure -s 16 -g 1

DRAM Bank Map Database

See: Found-DRAM-BankMap.md for examples of discovered DRAM bank-mapping functions.

Speed Comparison

Platform	DRAMA	DRAMA++
Xeon E3-1220 v5 (64 banks)	54.5s1	3.4s2
Raspberry Pi 4 (8 banks)	N/A	0.6s

• ¹ DRAMA option used: -s 64 -n 10 (the default n=5000 took more than 10 minutes and did not recover the map).
• ² DRAMA++ option used: -s 64 (manually setting a threshold such as -t 300 can make it even faster and more reliable).

Limitations

DRAMA++ currently assumes that the analyzed address space is governed by a single uniform XOR-based mapping. However, on asymmetric DIMMs or in systems with rank- or DIMM-specific address transformations, the observed timing behavior may reflect multiple local mappings rather than one global mapping. In this case, a reconstruction procedure based on a single GF(2) system may fail, even if each local mapping is individually linear or affine. Extending DRAMA++ to support such asymmetric configurations is left for future work.

Citation

If you use this tool, please cite:

@inproceedings{sullivan2026rtas,
    title = {{Per-Bank Memory Bandwidth Regulation for Predictable and Performant Real-Time Systems}},
    author = {Connor Sullivan and Amin Mamandipoor and Cole Strickler and Heechul Yun},
    booktitle = {IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS)},
    year = {2026},
    month = {May}
}