QEMU on iSH: notes & progress

iOS foundation is XNU/Darwin. There is no option (unless jailbreak) to run actual POSIX shell on top of kernel. Some applications provide similar experience, most notably a-Shell and iSH. a-Shell is mostly WebAssembly interpreter environment. POSIX commands aren’t native Mach-O executables, they are implemented via ios_system framework. iSH consists of i386 emulator, simple syscall emulation (no real kernel) & Alpine Linux userland. Unfortunately it doesn’t support some syscalls as real Linux kernel do, that’s why some applications are unusable. The only solution is to run full VM on top of this limited syscall subset. But qemu-* packages are broken: even though they are available in repositories, all of them give "Bad syscall" message when invoked even without any arguments Being able to run QEMU on iOS this way opens wide range of opportunities, such as running non-Alpine-based distributions and other non-Linux operating systems. There are even less implemented socket syscalls, but I hope they are enough to support QEMU’s slirp, which just puts packets into host’s network interface queue In order to run QEMU on iSH I configured and compiled minimal version of QEMU myself: no NUMA, no sophisticated syscalls, almost every feature provided by autoconf disabled, except mandatory ones. I patched sources a little. Some unimplemented syscalls were still hit. Executable segfaulted under gdb, so I patched MUSL to intercept and print syscall numbers as hit. That’s how I caught two of them — memfd_create(2) and signalfd(2). I implemented tiny memfd_create(2) myself in syscall interceptor and patched configure script, so it disables signalfd usage by default. That’s how I was able to at least print help message, copyright notice and version What do you think, how slow would it be? What architecture is fastest to emulate this way? submitted by /u/Capable-Cap9745 [link] [comments]

from hacking: security in practice https://ift.tt/JetUKdW