Clever Geek Handbook

Computing without instructions on x86

This article discusses the unusual use of the protected mode features of the x86 architecture - to perform computations without executing instructions, that is, due to the internal mechanisms of the processor: hardware task switching , ingenious memory management, and non-trivial logic of calling an interrupt handler . As you know , any somewhat complex system has Turing completeness , so it is not surprising to find it in unexpected places in the naturally evolved x86. I invite under the cut those interested in such low-level perversions.





This publication is based on an article titled "The Page-Fault Weird Machine: Lessons in Instruction-less Computation" . It warms the soul that one of its co-authors, Sergey Bratus , is a longtime graduate of Phystech . I first learned about this work from Gwern Barwen's article "Surprisingly Turing-Complete" , which contains many amazing examples of Turing-complete systems. By the way, part of it has been translated into Habré , although only three sentences are allocated to the phenomenon described in this article.





2013 , x86-64, long mode, . x86 .





, , , " ", . , : -, , , — ( QEMU, ). -, , . , , red pill, , . red pills , "", , , . red pill , , , "" . , , . , . : Neutrino(2016 .), Conficker(2008 .), Rebhip(2011 .), IRC : Phatbot(2008 .), Rbot, SDbot/Reptile, Mechbot, SpyBot ( ). -, . "" unikernel.





Red pill is a virtual environment detection program. Blue pill - malicious hypervisor
Red pill — , . Blue pill —

"" , , - ? , x86.





IA-32 , . call gates , , . , , — , ; . x86-64 .





, ( , , ), — 32-bit Linux ( ) double fault, , . Double fault , - ; , . , , double fault , , , , Linux , double fault , kernel panic "" . double fault - , triple fault, .





x86 , task-state segment(TSS). , , . EIP



(instruction pointer) — , ESP



(stack pointer) — , CR3



— ( , page directory), EAX



ECX



, .





TSS content. Pay attention to the location of CR3, EIP, EAX, ECX, EDX, ESP.
TSS. CR3, EIP, EAX, ECX, EDX, ESP.

, , . , , GDT(Global Descriptor Table) — IDT(Interrupt Descriptor Table) — . , , : memory segment descriptor — (, ), TSS descriptor — task-state segment, interrupt-gate descriptor — , , — far call. , — , — .





-

, , , -? , , page fault double fault, 4- . , , ( , x86 ) ESP



4. , ESP



, ? , 32 , double fault-.





. , , EIP



, , 0xFFFFFFFF



. page fault, . , page fault :





if (esp == 0) {
    goto double_fault_handler;
} else {
    esp -= 4;
    goto page_fault_handler;
}

- , … - . , "" . ( IDT GDT) TSS, CR3



, , , , (, TSS, ). IDTR GDTR ( TSS, ) IDT GDT, , "" ⇒ ⇒ ⇒ CR3



⇒ IDT GDT, . IDT TSS, .





Relationship between IDT, GDT and TSS. TR (Task Register) contains the index of the current TSS descriptor in the GDT.
IDT, GDT TSS. TR (Task Register) TSS GDT.

movdbz-

, "" :





  1. , "". IDT GDT, .





  2. TSS, , . , TSS EIP



    , ESP



    , CR3



    .





  3. "" TSS , ( ), ESP > 0



    , ESP



    4, ESP



    .





  4. CR3



    2 , ESP



    TSS, GDT (. Task Register) .





  5. 3 , , EIP



    , , page fault; double fault.





, : rsrc



— ESP



, TSS; rdest



— ESP



, TSS, GDT CR3



TSS. label_zero



— , double fault, label_nonzero



— page fault. ESP



, 4, , .





if (rsrc == 0) {
    rdest = rsrc;
    goto label_zero;
} else {
    rdest = rsrc - 1;
    goto label_nonzero;
}

— , movdbz



, move-branch-if-zero-or-decrement (-----). , subtract-and-branch-if-negative (-----), movdbz



( ), - . , , — - Brainfuck movdbz



-.





, movdbz



:





movdbz rdest, rsrc, label_nonzero, label_zero

( ), . movdbz



, x86. EIP



TSS.





real-mode A20 high memory, , . , Intel , , , . , ESP



( #SS



— stack-segment fault), . ESP



, 4 "" , 0 1023, 0 4095 ( 4 ). , , .





,





: 4 "destination TSS" ESP



, CR3



. , , ESP



, TSS, -- , . CR3



, , CR3



IDT



, , — "". TSS — , ; , movdbz



. "" TSS ECX



EDX



( TSS ). , TSS ESP



, CR3



TSS c rdest



, .





Busy bit





busy bit, TSS GDT , . , , 5 . , , . , , . , , , , , 8 10, .





: GDT , TSS! GDT 16 , 8 — , , TSS, EAX



ECX



. , TSS EAX



ECX



TSS ( , TSS) busy bit-. , TSS 4 busy bit TSS GDT . IDT GDT — , 8 16 .





, " "? -, , , — red pill, . -, x86, . -, , , , " " , . — " ", "" , . , , .





( ):











More articles:


All Articles