X86 MMU fault handling is turing complete
1–10 of 41 posts
Re: X86 MMU fault handling is turing complete
#2>Move, Branch if Zero, Decrement
This is basically the canonical instruction for OISCs (one instruction set computers). Wikipedia describes it pretty well: https://en.wikipedia.org/wiki/One_instruction_set_computer#S....
Re: X86 MMU fault handling is turing complete
#3Another place for root kits to hide.
Re: X86 MMU fault handling is turing complete
#4This is more or less the greatest thing I've learned about in the last couple years.
What's happening here is that they're getting computation without executing any instructions, simply through the process of using the MMU hardware to "resolve addresses". The page directory system has been set up in such a way that address resolution effects a virtual machine that they can code to.
This works because when you attempt to resolve an invalid address, the CPU generates a trap (#PF), and the handling of that trap pushes information on the "stack". Each time you push data to the stack, you decrement the stack pointer. Eventually, the stack pointer underflows; when that happens, a different trap (#DF) fires. This mechanism put together gives you:
if x The virtual machine "runs" by generating an unending series of traps: in the "goto a" case, the result of translation is another address generating a trap. And so on.
The details of how this computer has "memory" and addresses instructions is even headachier. They're using the x86 TSS as "memory" and for technical reasons they get 16 slots (and thus instructions) to work with, but they have a compiler that builds arbitrary programs into 16-colored graphs to use those slots to express generic programs. Every emulator they could find crashes when they abuse the hardware task switching system this way.
Here's it running Conway's Life:
http://youtubedoubler.com/?video1=E2VCwBzGdPM&start1=0&#...
Here's their talk for a few months back:
http://www.youtube.com/watch?v=NGXvJ1GKBKM
The talk is great, but if you're not super interested in X86/X64 memory corruption countermeasures, you might want to skip the first 30 minutes.
Re: X86 MMU fault handling is turing complete
#5Another place for root kits to hide.
can you please elaborate?
Re: X86 MMU fault handling is turing complete
#6This is more or less the greatest thing I've learned about in the last couple years. What's happening here is that they're getting computation without executing any instructions , simply through the process of using the MMU hardware to "resolve addresses". The page directory system has been set up in such a way that address resolution effects a virtual machine that they can code to. This works because when you attemp…
The slides in the github repo ( https://github.com/jbangert/trapcc/blob/master/slides/PFLA-s... ) also have a few interesting points, like "No publicly available simulator implements this correctly" (how did they record the youtube video?) and a few vague hints about exploiting this for doing VM escapes.
Re: X86 MMU fault handling is turing complete
#7This is more or less the greatest thing I've learned about in the last couple years. What's happening here is that they're getting computation without executing any instructions , simply through the process of using the MMU hardware to "resolve addresses". The page directory system has been set up in such a way that address resolution effects a virtual machine that they can code to. This works because when you attemp…
The slides in the github repo ( https://github.com/jbangert/trapcc/blob/master/slides/PFLA-s... ) also have a few interesting points, like "No publicly available simulator implements this correctly" (how did they record the youtube video?) and a few vague hints about exploiting this for doing VM escapes.
> "No publicly available simulator implements this correctly" (how did they record the youtube video?)
Probably by patching the emulator.
Re: X86 MMU fault handling is turing complete
#8This is more or less the greatest thing I've learned about in the last couple years. What's happening here is that they're getting computation without executing any instructions , simply through the process of using the MMU hardware to "resolve addresses". The page directory system has been set up in such a way that address resolution effects a virtual machine that they can code to. This works because when you attemp…
The slides in the github repo ( https://github.com/jbangert/trapcc/blob/master/slides/PFLA-s... ) also have a few interesting points, like "No publicly available simulator implements this correctly" (how did they record the youtube video?) and a few vague hints about exploiting this for doing VM escapes.
By fixing bugs in Bochs?
Re: X86 MMU fault handling is turing complete
#9Re: X86 MMU fault handling is turing complete
#10Another place for root kits to hide.
[deleted]