11

The trapcc project on Github by Sergey Bratus and Julian Bangert claims that using the Turing complete capabilities of x86 MMU it is possible for a code to escape the virtual machine using a single instruction (Move, Branch if Zero, Decrement). It does so by page faults and double faults. I tried to read the paper but it seemed too puzzling. Is the idea feasible?

  • 4
    I don't see any claims that this can be used to escape a VM. It's mostly just to demonstrate a neat trick, though it can potentially be used for obfuscation as well. – Antimony Aug 14 '13 at 14:59
  • and due to the fact that there is no mention of escape, I dislike the title, since it is highly misleading. – peter ferrie Aug 18 '13 at 4:56
13

In fact, they do not claim at all to evade from any virtual machine. But, by using the MMU fault handler mechanism to perform computation, they expect to render the encapsulation of their program unpractical. Indeed, the point is to find unexpected primitives to perform computation, doing so only a few virtual machine environments will be able handle such specific programs. And, even if they do, a virtual machine is managed by an hypervisor which will probably be overwhelmed by the handling of all the interrupt signals that such a program requires.

So, in fact, they propose a way of programming that is as powerful as C (Turing-complete) but that will be extremely tedious to run in a virtualized environment.

Of course, the goal of this is to slow down the analysis of the program when run in a virtual machine (this is to be compared to the anti-debug techniques to avoid dynamic analysis).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.