5 ms·
Vx32: Portable, efficient, safe user-space execution of untrusted x86 code (2008)
- yjftsjthsd-h 3y agoSuper cool project; I think it's kind of sad that it didn't get picked up and become more popular. The Plan 9 port is particularly impressive, in my opinion:) (It would be interesting to compare that to User Mode Linux, come to think of it)
- muricula 3y agoWas this the predecessor to Google Native Client? https://en.wikipedia.org/wiki/Google_Native_Client https://en.wikipedia.org/wiki/Google_Native_Client
- redog 3y agoDoesn't look like it: https://www.chromium.org/nativeclient/reference/external-resource-directory/ https://www.chromium.org/nativeclient/reference/external-res...
- Karliss 3y agoThere are some similarities to the 32 bit x86 NaCL and one of the early NaCl paper mentions this. https://storage.googleapis.com/pub-tools-public-publication-data/pdf/34913.pdf https://storage.googleapis.com/pub-tools-public-publication-... They both use x86 memory segment functionality for limiting memory access, but seems like there are also plenty of things they do differently. And the x86_64 and ARM versions of NaCl are even more different, they can't use the segment registers so they use masking instead.
- littlestymaar 3y ago(2008)
- nneonneo 3y agoAlso see Unicorn (https://www.unicorn-engine.org/ https://www.unicorn-engine.org/), a QEMU-based emulator-as-a-library that handles a wide range of processors (ARM, AArch64, x86, x64, PowerPC, MIPS, SPARC, …) and comes with bindings for many popular languages (C, Python, Rust, Java, …). Unicorn is used quite widely for reverse engineering and malware analysis; the Qiling project (https://qiling.io/ https://qiling.io/) extends it to OS-level emulation.
- nerpderp82 3y agoI was just looking for QEMU as a library, thank you!
- karmakaze 3y agoAh. I can see how this might be useful for supporting a large library of plugins for various applications and industries. > Vx32 is similar in purpose to the Java or .NET virtual machines, but it runs native x86 code, so plug-ins can be written in ANY language, not just Java or C#.
- remram 3y agoThat are many languages that can run on the JVM.
- yjftsjthsd-h 3y agoThere are a decent number of JVM-targeting languages, but they still utterly pale before the number of languages that target x86.
- pizlonator 3y agoThe link to the paper in that page doesn’t work but I found it here: https://pdos.csail.mit.edu/papers/vx32:usenix08.pdf https://pdos.csail.mit.edu/papers/vx32:usenix08.pdf Very cool technique, but I’m not enough of a DBT expert to judge how significant it is compared to the many many DBTs that folks have built before and since.
- kragen 3y agoguessing dbt means https://en.wikipedia.org/wiki/Binary_translation#Dynamic_binary_translation https://en.wikipedia.org/wiki/Binary_translation#Dynamic_bin...
- Karliss 3y agoI guess at this point same process native code sandboxing approaches like Vx32 and NaCl are more or less dead due to the various speculative execution attacks that came up in the recent few years.
- remram 3y agoYou can take the same approach as browsers: block the guest from using high-precision timing functions.
- rwmj 3y agoCan't you synthesize these from simple loops, especially if the untrusted code is able to use threads?
- remram 3y agoYou mean only if the untrusted code is able to use threads. Yes maybe, that just makes it even less reliable and time-consuming.
- c7DJTLrn 3y agoThat's a mitigation, not a solution unfortunately. There have been PoCs that work without high precision timing.
- pjmlp 3y agoSame applies to WASM, regardless of the security sales pitch.
- jgrahamc 3y agoPaging majke who used this a lot at Cloudflare at one point.
- majke 3y agoI used vx32 as a technical demo before workers came to be. It was super useful. However, vx32 itself is very much not production ready. There are issues with instruction decoding, floating point, and interrupt handling. (it uses itimer as a schedululer tick for preemption). I think playing with vx32 is a great experience, taught me way more than all my systems programming classes at uni. Vx32 was a predecessor to NaCL, and shared the same problems. Nowadays WASI seems to have taken this niche.
- deleted 3y ago[deleted]
- nerpderp82 3y agoBTW, VX32 is paying homage to https://en.wikipedia.org/wiki/FX!32 https://en.wikipedia.org/wiki/FX!32 the first ground breaking binary translation tool that allowed x86 binaries to run on Alpha (at faster than x86 speeds).
- Lerc 3y agoBack in the day I put VX32 into a npapi plugin to run x86 code in-browser. I was working with an XO-1 at the time. It made for a decent flash-like-content experience without running at a crawl on the modest CPU. I think I put it on google code, so I guess it's gone now. Then again so is npapi.
- fsmv 3y agoFrom [the slides](https://pdos.csail.mit.edu/papers/vxa:fast05-slides.pdf https://pdos.csail.mit.edu/papers/vxa:fast05-slides.pdf) it sounds like what they do is rewrite the code so syscall call into the vx32 runtime library instead and this prevents all syscalls except for the small handful they support. That in addition to memory sandboxing. So it doesn't really just run any random untrusted code, it has to be prepared to work with their sandboxing. The main purpose of this is being a self extracting archive not running untrusted code.