[__bjoernd]

Yes, you'd write some assembly or C. Or your start from existing demos: https://samsclass.info/123/proj14/spectre.htm

[saagarjha]

You don't need to write assembly or C; it is possible to perform an exploit by utilizing any high-resolution clock, like the one JavaScript on most browsers provided until recently.