Replication Data for: Physical Memory Please: Practical Memory-Aliasing Attacks on RISC-V PMP

This repository contains the scripts and tools to perform BadRAM attacks on RISC-V, as well as the proof-of-concept and end-to-end attacks presented in our paper under keystone-milkv/examples. The paper shows that BadRAM memory‑aliasing attacks can fully bypass RISC‑V PMP isolation, enabling complete compromise of Keystone TEEs. It also demonstrates a practical firmware‑level mitigation, highlighting that x86‑style microarchitectural attacks directly translate to emerging RISC‑V security architectures.