7 ms·
The original post deserves an award for tech writing, https://cohost.org/cathoderaydude/post/1228730-taking-the-deepest-p https://cohost.org/cathoderaydude/post
by stacktrust 3y ago
The original post deserves an award for tech writing, https://cohost.org/cathoderaydude/post/1228730-taking-the-deepest-p https://cohost.org/cathoderaydude/post/1228730-taking-the-de...
> Windows gets itself all ready for sleep, tucks itself in, then tells the BIOS "too eepy! time for bed, S3~" but instead of the S3 reaching the BIOS, OSM intercepts that call. The OS has halted itself, and is waiting to be told that it's time to wake up, but OSM instead proceeds to alter the universe around it ... the OSM will move all the memory pointers around, then reverse the sleep process, causing the machine to instantly "wake" - from a sleep it never actually entered.
> Windows thinks it's taking a nap, but it wakes up as someone else, leaves the house, and commits murders it has no memory of. In other words: Phoenix figured out how to turn the BIOS into a hypervisor. It's almost, almost beautiful, if it wasn't both incredibly fragile and completely uncalled-for. But christ. Christ almighty, what a hack. One could come to tears over it.
There is a software archaeology epilogue waiting to be written, based on artifact reverse engineering and a trail of public breadcrumbs:
Hyperspace was acquired by HP.
Hyperspace creator left HP and founded Bromium (acquired by HP in 2019).
Bromium productized OSS Type-2 Xen (uXen microvisor), copy-on-write VMs in 150ms.
Microsoft cloned Bromium vSentry as Defender - Application Guard.
Bromium AX ships on HP biz laptops /w nested x86 virt for OS+UEFI virt.
OSS Bareflank hypervisor = attempt at replicating AX (Windows-as-dom0).
OSS Android 13 pKVM-for-Arm is closest OSS in spirit to Bromium AX.
In other words, conceptual descendants of the Phoenix Hyperspace hack are shipping today on millions of Android and Windows systems. In 2018, https://github.com/rust-vmm/community#why-rust-vmm https://github.com/rust-vmm/community#why-rust-vmm deduped CrosVM (Chromebooks) and Firecracker (public cloud) micro VMs on KVM.
Industry needs an OSS Type-1 L0 hypervisor: https://twitter.com/stacktrust/status/1640145980833005568 https://twitter.com/stacktrust/status/1640145980833005568
Video with virtualization history of Xen (Type 1), uXen (Type 2) and Bromium/HP AX (Type1 L0 for nesting of Xen, KVM, VMware, Hyper-V): https://www.youtube.com/watch?v=bNVe2y34dnM https://www.youtube.com/watch?v=bNVe2y34dnM)
pKVM baby step towards dropping SMM/TrustZone: https://twitter.com/stacktrust/status/1595951965699473408 https://twitter.com/stacktrust/status/1595951965699473408
- nikanj 3y agoThis writing sounds like stuff from James Mickens ( https://mickens.seas.harvard.edu/wisdom-james-mickens https://mickens.seas.harvard.edu/wisdom-james-mickens )