Have they published the proof-of-concept code? I understand how you can use timing measurements to determine layout in theory, but what javascript statements a

Have they published the proof-of-concept code? I understand how you can use timing measurements to determine layout in theory, but what javascript statements are you running that can reveal where msvcrt.dll or kernel32.dll is loaded in chrome.exe?