6 ms·
X86 MMU fault handling is turing complete
- networked 14y ago>Move, Branch if Zero, Decrement This is basically the canonical instruction for OISCs (one instruction set computers). Wikipedia describes it pretty well: https://en.wikipedia.org/wiki/One_instruction_set_computer#Subtract_and_branch_if_less_than_or_equal_to_zero https://en.wikipedia.org/wiki/One_instruction_set_computer#S....
- codex 14y agoAnother place for root kits to hide.
- iamrohitbanga 14y agocan you please elaborate?
- jpollock 14y agoIt's computation that you can't see with a debugger, or with any sort of tracing.
- duaneb 14y agoYou can't see the code, but surely it can't do anything useful—i.e. change anything outside its extremely limited memory.
- phyalow 14y agoIf you read through the slides @ https://github.com/jbangert/trapcc/blob/master/slides/PFLA-shmoocon.pdf https://github.com/jbangert/trapcc/blob/master/slides/PFLA-s... there is potential to bypass hardware memory protection. Very interesting.
- 0x0 14y agoI must have missed the limited ram access when I browsed the slides the first time, I just assumed the youtube Game of Life proved they were poking ascii 'X' chars into video ram at 0xb8000 or whatever. Is there a trick/cheat to how that visualization was done? Edit: browsed around the code some more and it seems the ascii visualization stuff is done in regular c/asm polling the "virtual game of life" mem(?)
- duaneb 14y agoAhh, ok. Might actually be enough to, say, copy an encryption key out of kernel memory then?
- limmeau 14y agoMost of the techniques described in the slides require ring-0 privileges (replacing descriptor tables and page tables etc). If you have those privileges, you can copy what you want anyway. Unless the encryption key is guarded by something with SMM privileges -- has that been done?
- duaneb 14y agoWell the original idea was a rootkit, which traditionally requires ring-0 privileges to install in the first case.
- ithkuil 14y ago
- deleted 14y ago[deleted]
- tomrod 14y agoCould one write a preemptive rootkit that sniffs for other rootkits? Would that slow things down incredibly?
- simias 14y agoThat's called an antivirus :)
- tptacek 14y agoThis is more or less the greatest thing I've learned about in the last couple years. What's happening here is that they're getting computation without executing any instructions, simply through the process of using the MMU hardware to "resolve addresses". The page directory system has been set up in such a way that address resolution effects a virtual machine that they can code to. This works because when you attempt to resolve an invalid address, the CPU generates a trap (#PF), and the handling of that trap pushes information on the "stack". Each time you push data to the stack, you decrement the stack pointer. Eventually, the stack pointer underflows; when that happens, a different trap (#DF) fires. This mechanism put together gives you: if x < 4 { goto b } else { x = x - 4 ; goto a } also known as "subtract and branch if less than or equal to zero", also known as "an instruction adequate to construct a one-instruction computer". The virtual machine "runs" by generating an unending series of traps: in the "goto a" case, the result of translation is another address generating a trap. And so on. The details of how this computer has "memory" and addresses instructions is even headachier. They're using the x86 TSS as "memory" and for technical reasons they get 16 slots (and thus instructions) to work with, but they have a compiler that builds arbitrary programs into 16-colored graphs to use those slots to express generic programs. Every emulator they could find crashes when they abuse the hardware task switching system this way. Here's it running Conway's Life: http://youtubedoubler.com/?video1=E2VCwBzGdPM&start1=0&video2=eSRcvrVs5ug&start2=0&authorName=FAV http://youtubedoubler.com/?video1=E2VCwBzGdPM&start1=0&#... Here's their talk for a few months back: http://www.youtube.com/watch?v=NGXvJ1GKBKM http://www.youtube.com/watch?v=NGXvJ1GKBKM The talk is great, but if you're not super interested in X86/X64 memory corruption countermeasures, you might want to skip the first 30 minutes.
- 0x0 14y agoThe slides in the github repo ( https://github.com/jbangert/trapcc/blob/master/slides/PFLA-shmoocon.pdf https://github.com/jbangert/trapcc/blob/master/slides/PFLA-s... ) also have a few interesting points, like "No publicly available simulator implements this correctly" (how did they record the youtube video?) and a few vague hints about exploiting this for doing VM escapes.
- jey 14y ago
- general_failure 14y agosomebody checked in vim backup files :-)
- ithkuil 14y agoif you like this kind of things there is also: http://www.cs.dartmouth.edu/~bx/elf-bf-tools/slides/ELF-berlinsides-0x3.pdf http://www.cs.dartmouth.edu/~bx/elf-bf-tools/slides/ELF-berl...
- jbangert 14y agoAuthor here: While it is true that with the current implementation, memory access is extremely limited (essentially one DWORD per page, or about 0.1% of the available physical RAM) that limitation can certainly be avoided. For one, you could shift how the TSS is aligned (and align them differently for different instructions), multiplying your address space by a factor of 10 or so. Furthermore, you could also place another TSS somewhere in memory (only a few of the variables need to actually contain sane values) with an invalid EIP and use that as a 'load' instruction. The easiest way however would be to use the TrapCC mechanism to transfer control between bits of normal assembler code (perhaps repurposed from other functions already in your kernel), doing something similar to ROP. Of course, for additional fun, feel free to throw in BX's Brainfuck interpreter in ELF and James Oakley's DWARF exception handler. We might drop a demo of this soon, i.e. implementing a self-decrypting binary via page faults.
- sounds 14y ago"memory access is extremely limited (essentially one DWORD per page" – referring to non-code addresses, yes? In the current (simplest) implementation, each instruction (a TSS) must be aligned across a page boundary. You do comment below that altering alignment could increase the available code space. I'm wondering what method PFLA uses to read/write non-code addresses. Only one address per page can be addressed? I'll take a look at the compiler. By simply expanding the addressing capability, a very tiny program could emulate an instruction stream from memory, overcoming the limited code space (at the cost of execution speed). Cheers!
- majke 14y agoThere was a talk on 29c3 about this. Abstract: https://events.ccc.de/congress/2012/Fahrplan/events/5265.en.html https://events.ccc.de/congress/2012/Fahrplan/events/5265.en.... video: https://www.youtube.com/watch?v=NGXvJ1GKBKM https://www.youtube.com/watch?v=NGXvJ1GKBKM
- rocky1138 14y agoThis is really interesting. In a way, it's a form of computer self-replication. Could the virtual machine created by the computer be considered offspring? Is there a way the virtual machine might spawn another virtual machine child of its own?
- ars 14y agoHow fast (slow) is this relative to the host CPU?
- simias 14y agoProbably incredibly slow given the reduced instruction set and that it relies on context switches/pushing stuff on the stack for functioning.
- traxtech 14y agoThat the hardware version of the brainfuck philosophy.
- switch33 14y agoBest explanation ever. I second this. lol
- conductor 14y agoExpect this technique in the future malwares and software protection DRM systems for making code analyzing harder.