Comment by nicoburns
3 years ago
The m1n1 hypervisor specialised for debugging is a pretty genius idea. Is anyone aware of anyone else taking a similar approach? Seems like it would be a pretty generally applicable technique and would make OS/hardware driver development a lot more approachable.
Even before true CPU-supported "hypervisors," there was shim software like SoftICE that worked similarly to m1n1 in that you would run an OS underneath and then use a supervisor tool to trace and debug the OS under inspection.
More recently, it's fairly common to use a hypervisor or simulator for kernel debugging in device driver development on Windows via Hyper-V.
A lot of Linux driver development is done using qemu as well, although this is usually more targeted and isn't quite the same "put a thin shim over the OS running on the hardware" approach.
The flexibility and I/O tracing framework in m1n1 are pretty uniquely powerful, though, since it was built for reverse engineering specifically.
Some developers used user mode Linux for driver development, and I think some development has happened on the NetBSD rump kernel more recently. I find the work that goes into building this kind of tooling all pretty impressive.
The nouveau project used a kernel module to intercept mmio accesses: https://nouveau.freedesktop.org/MmioTrace.html. Generally speaking hooking onto driver code is one of the preferred ways of doing dynamic reverse engineering. For userspace components, you can build an LD_PRELOAD stub that logs ioctls, and so on.
Not that I know of. m1n1 originated from software that (IIRC) was used initially for reverse-engineering the Wii.
Idea wise actually S/360 run on hardware microcode and all these idea of virtual machine and hypervisor came from an unauthorised development called CP67 or later VM. IBM used it for development MVS etc. as some hardware is yet to be built for certain features.
But the modern day these development is crazy.
How can yo manage a 100+ structure in a language you just learnt (Rust) for a secret GPU the vendor does not share info.