ok, so the gist of speculative store bypass attack to my understanding is that, cpu chooses the most frequent code path, bypass the if/else test and just assumes that it's true/false and then execute it onwards. later if the prediction proved to be wrong it simply discards the speculative execution results. but somehow the attacker could measure the discarded result and gain some information from the code he does not own(has privilege to access).
My question would be, in order for attacker to extract some useful information, should the attacker have some assembly level code understanding, or even source code level understanding of the targeted program? or how else is he gonna deteremine what the value he measured from data cache represents?