Vx32: Portable, efficient, safe user-space execution of untrusted x86 code (2008) | Hacker News Reader

Vx32: Portable, efficient, safe user-space execution of untrusted x86 code (2008)

pdos.csail.mit.edu

89 pointsnateb202223 comments

Also see Unicorn (https://www.unicorn-engine.org/), a QEMU-based emulator-as-a-library that handles a wide range of processors (ARM, AArch64, x86, x64, PowerPC, MIPS, SPARC, …) and comes with bindings for many popular languages (C, Python, Rust, Java, …).

Unicorn is used quite widely for reverse engineering and malware analysis; the Qiling project (https://qiling.io/) extends it to OS-level emulation.

I was just looking for QEMU as a library, thank you!

BTW, VX32 is paying homage to https://en.wikipedia.org/wiki/FX!32 the first ground breaking binary translation tool that allowed x86 binaries to run on Alpha (at faster than x86 speeds).

I guess at this point same process native code sandboxing approaches like Vx32 and NaCl are more or less dead due to the various speculative execution attacks that came up in the recent few years.

You can take the same approach as browsers: block the guest from using high-precision timing functions.

Can't you synthesize these from simple loops, especially if the untrusted code is able to use threads?

You mean only if the untrusted code is able to use threads. Yes maybe, that just makes it even less reliable and time-consuming.

That's a mitigation, not a solution unfortunately. There have been PoCs that work without high precision timing.

Same applies to WASM, regardless of the security sales pitch.

The link to the paper in that page doesn’t work but I found it here: https://pdos.csail.mit.edu/papers/vx32:usenix08.pdf

Very cool technique, but I’m not enough of a DBT expert to judge how significant it is compared to the many many DBTs that folks have built before and since.

guessing dbt means https://en.wikipedia.org/wiki/Binary_translation#Dynamic_bin...

Back in the day I put VX32 into a npapi plugin to run x86 code in-browser. I was working with an XO-1 at the time. It made for a decent flash-like-content experience without running at a crawl on the modest CPU.

I think I put it on google code, so I guess it's gone now. Then again so is npapi.

From [the slides](https://pdos.csail.mit.edu/papers/vxa:fast05-slides.pdf) it sounds like what they do is rewrite the code so syscall call into the vx32 runtime library instead and this prevents all syscalls except for the small handful they support. That in addition to memory sandboxing.

So it doesn't really just run any random untrusted code, it has to be prepared to work with their sandboxing.

The main purpose of this is being a self extracting archive not running untrusted code.

Ah. I can see how this might be useful for supporting a large library of plugins for various applications and industries.

> Vx32 is similar in purpose to the Java or .NET virtual machines, but it runs native x86 code, so plug-ins can be written in ANY language, not just Java or C#.

That are many languages that can run on the JVM.

There are a decent number of JVM-targeting languages, but they still utterly pale before the number of languages that target x86.

Was this the predecessor to Google Native Client? https://en.wikipedia.org/wiki/Google_Native_Client

Doesn't look like it: https://www.chromium.org/nativeclient/reference/external-res...

There are some similarities to the 32 bit x86 NaCL and one of the early NaCl paper mentions this. https://storage.googleapis.com/pub-tools-public-publication-...

They both use x86 memory segment functionality for limiting memory access, but seems like there are also plenty of things they do differently. And the x86_64 and ARM versions of NaCl are even more different, they can't use the segment registers so they use masking instead.

Super cool project; I think it's kind of sad that it didn't get picked up and become more popular. The Plan 9 port is particularly impressive, in my opinion:) (It would be interesting to compare that to User Mode Linux, come to think of it)

Paging majke who used this a lot at Cloudflare at one point.

I used vx32 as a technical demo before workers came to be. It was super useful.

However, vx32 itself is very much not production ready. There are issues with instruction decoding, floating point, and interrupt handling. (it uses itimer as a schedululer tick for preemption).

I think playing with vx32 is a great experience, taught me way more than all my systems programming classes at uni.

Vx32 was a predecessor to NaCL, and shared the same problems. Nowadays WASI seems to have taken this niche.

(2008)

Reply on news.ycombinator.com