5 ms·

Possibly related - https://x.com/0xjprx/status/1753575170101461266?s=20 https://x.com/0xjprx/status/1753575170101461266?s=20 > The world's first(?) kernel expl

by judge2020 3y ago

Possibly related - https://x.com/0xjprx/status/1753575170101461266?s=20 https://x.com/0xjprx/status/1753575170101461266?s=20 > The world's first(?) kernel exploit for Vision Pro- on launch day! image 1: https://pbs.twimg.com/media/GFXzO5kXMAA-y7k?format=jpg&name=4096x4096 https://pbs.twimg.com/media/GFXzO5kXMAA-y7k?format=jpg&name=... image 2: https://pbs.twimg.com/media/GFXzQOJWYAA41sV?format=jpg&name=large https://pbs.twimg.com/media/GFXzQOJWYAA41sV?format=jpg&name=...

charcircuit 3y ago
That only shows a kernel panic. An exploit would prevent the kernel from crashing.
- swozey 3y ago
  How can malware prevent a panic? Its process is priority over pid1? I'm very ignorant to this stuff. Wouldn't the kernel know it's being manipulated, like a startup/JIT checksum or something?
  - mort96 3y ago
    A kernel panic is caused by some serious issue in either the kernel or the hardware. In itself, it's relatively "harmless": it just means the OS stops doing anything and you need to hard reboot the machine (such as by cutting power). However, if the kernel panic is caused by a software bug (rather than something like a broken RAM stick), then the bug which causes the kernel panic might also be exploitable by malicious code to do things like arbitrary kernel level code execution. For example, if the problem is that the kernel somehow allows the user to change a piece of memory which the kernel interprets as a function pointer, then the result of carelessly changing that piece of memory will cause the kernel to jump into some part of memory that's not valid code, causing a kernel panic; however, a very clever attacker may pick a jump address which causes the kernel to keep executing without crashing but doing something which the developer of the kernel didn't intend. Maybe the attacker can cause the kernel to jump to a location in memory which the attacker has control over, which would mean that the attacker can run arbitrary code in kernel mode. This stuff is all very complicated and very interesting, I recommend reading up on it if it interests you. And no, the kernel can't really check if it's being manipulated. A checksum at startup wouldn't do it since these sorts of exploits don't tend to involve changing the kernel bytes on disk, but rather tricking the kernel into doing something it's not supposed to. There are various mechanisms to try to make bugs unexploitable (such as address space layout randomisation), but fundamentally, you can't perfectly protect against potential bugs.
    - swozey 3y ago
      Thanks! Yeah I really need to work on my low level security knowledge this stuff is fascinating when it isn't presented in the form of a crypto algorithim that is heirogylphics to me.
  - PeterisP 3y ago
    The general idea is that an exploitable remote code execution bug is some specific circumstances where the processor starts to execute whatever is in some wrong address which can be manipulated by an attacker. If the bug is successfully exploited, the attacker arranges so that everything is just so that device runs "as if normal" but executes whatever code attacker decided to be executed; but if the bug is triggered accidentally or without a working exploit, then it attempts to execute something random and that results in a kernel panic. So the way how "malware prevents a kernel panic" is that it's a successful exploit if and only if it manages to ensure that valid (but attacker-controlled) code runs and actually works, and if it instead results in a kernel panic, well, that's not a working malware, unless all the attacker wanted was a denial of service exploit.
bpye 3y ago
I'm kind of impressed that a kernel panic doesn't just result in a black screen and that passthrough still works.
- teaearlgraycold 3y ago
  I’m not super informed here, but I believe the AR stuff, including eye tracking, takes place on a coprocessor. The OS on the M2 chip could die and you’d still have passthrough.
  - hparadiz 3y ago
    Valve Index is similiar. I've had my whole desktop freeze but the spatial orientation is still drawing within the VR as the headset is moving albiet in a frozen state.
    - charcircuit 3y ago
      The Valve Index does not do reprojection on the device. It does not even do tracking on the device.
      - FirmwareBurner 3y ago
        It does it on the PC?
        charcircuit 3y ago
        Yes, the runtime handles interpreting the sensor data collected by the device to compute the position and orientation they are in space. The compositor will reproject the next frame it sends to the headset if the application producing the frames does not submit frames before the deadline.
        DOGMATICA 3y ago
        SteamVR’s tracking page[1] explains it a little. The HMD is really just displays, radios to talk the controllers (standalone trackers will just have a dongle, runs the same firmware iirc), and its own chip to talk to its own tracking sensors. All the tracking stuff amounts to timing information which is screamed over USB to the PC which does all the math to figure out where you are. A bulk of this (really interesting!) information can be found on their HDK documentation, but that requires you to sign up with Steamworks. [1]: https://partner.steamgames.com/vrlicensing https://partner.steamgames.com/vrlicensing
qingcharles 3y ago
RealityDevice running on xrOS.

charcircuit 3y ago

That only shows a kernel panic. An exploit would prevent the kernel from crashing.

swozey 3y ago
How can malware prevent a panic? Its process is priority over pid1? I'm very ignorant to this stuff. Wouldn't the kernel know it's being manipulated, like a startup/JIT checksum or something?
- mort96 3y ago
  A kernel panic is caused by some serious issue in either the kernel or the hardware. In itself, it's relatively "harmless": it just means the OS stops doing anything and you need to hard reboot the machine (such as by cutting power). However, if the kernel panic is caused by a software bug (rather than something like a broken RAM stick), then the bug which causes the kernel panic might also be exploitable by malicious code to do things like arbitrary kernel level code execution. For example, if the problem is that the kernel somehow allows the user to change a piece of memory which the kernel interprets as a function pointer, then the result of carelessly changing that piece of memory will cause the kernel to jump into some part of memory that's not valid code, causing a kernel panic; however, a very clever attacker may pick a jump address which causes the kernel to keep executing without crashing but doing something which the developer of the kernel didn't intend. Maybe the attacker can cause the kernel to jump to a location in memory which the attacker has control over, which would mean that the attacker can run arbitrary code in kernel mode. This stuff is all very complicated and very interesting, I recommend reading up on it if it interests you. And no, the kernel can't really check if it's being manipulated. A checksum at startup wouldn't do it since these sorts of exploits don't tend to involve changing the kernel bytes on disk, but rather tricking the kernel into doing something it's not supposed to. There are various mechanisms to try to make bugs unexploitable (such as address space layout randomisation), but fundamentally, you can't perfectly protect against potential bugs.
  - swozey 3y ago
    Thanks! Yeah I really need to work on my low level security knowledge this stuff is fascinating when it isn't presented in the form of a crypto algorithim that is heirogylphics to me.
- PeterisP 3y ago
  The general idea is that an exploitable remote code execution bug is some specific circumstances where the processor starts to execute whatever is in some wrong address which can be manipulated by an attacker. If the bug is successfully exploited, the attacker arranges so that everything is just so that device runs "as if normal" but executes whatever code attacker decided to be executed; but if the bug is triggered accidentally or without a working exploit, then it attempts to execute something random and that results in a kernel panic. So the way how "malware prevents a kernel panic" is that it's a successful exploit if and only if it manages to ensure that valid (but attacker-controlled) code runs and actually works, and if it instead results in a kernel panic, well, that's not a working malware, unless all the attacker wanted was a denial of service exploit.

bpye 3y ago

I'm kind of impressed that a kernel panic doesn't just result in a black screen and that passthrough still works.

teaearlgraycold 3y ago
I’m not super informed here, but I believe the AR stuff, including eye tracking, takes place on a coprocessor. The OS on the M2 chip could die and you’d still have passthrough.
- hparadiz 3y ago
  Valve Index is similiar. I've had my whole desktop freeze but the spatial orientation is still drawing within the VR as the headset is moving albiet in a frozen state.
  - charcircuit 3y ago
    The Valve Index does not do reprojection on the device. It does not even do tracking on the device.
    - FirmwareBurner 3y ago
      It does it on the PC?
      - charcircuit 3y ago
        Yes, the runtime handles interpreting the sensor data collected by the device to compute the position and orientation they are in space. The compositor will reproject the next frame it sends to the headset if the application producing the frames does not submit frames before the deadline.
      - DOGMATICA 3y ago
        SteamVR’s tracking page[1] explains it a little. The HMD is really just displays, radios to talk the controllers (standalone trackers will just have a dongle, runs the same firmware iirc), and its own chip to talk to its own tracking sensors. All the tracking stuff amounts to timing information which is screamed over USB to the PC which does all the math to figure out where you are. A bulk of this (really interesting!) information can be found on their HDK documentation, but that requires you to sign up with Steamworks. [1]: https://partner.steamgames.com/vrlicensing https://partner.steamgames.com/vrlicensing

qingcharles 3y ago

RealityDevice running on xrOS.