Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1
■■ Enhanced functionality: When a program is running under a virtual
machine, it can (and usually does) benefit from a wide range of
enhanced features that are rarely found on real silicon processors. This
can include features such as garbage collection, which is an automated
system that tracks resource usage and automatically releases memory
objects once they are no longer in use. Another prominent feature is
runtime type safety: because virtual machines have accurate data type
information on the program being executed, they can verify that type
safety is maintained throughout the program. Some virtual machines
can also track memory accesses and make sure that they are legal.
Because the virtual machine knows the exact length of each memory
block and is able to track its usage throughout the application, it can
easily detect cases where the program attempts to read or write beyond
the end of a memory block, and so on.

Bytecodes

The interesting thing about virtual machines is that they almost always have
their own bytecode format. This is essentially a low-level language that is just
like a hardware processor’s assembly language (such as the IA-32 assembly
language). The difference of course is in how such binary code is executed.
Unlike conventional binary programs, in which each instruction is decoded
and executed by the hardware, virtual machines perform their own decoding
of the program binaries. This is what enables such tight control over every-
thing that the program does; because each instruction that is executed must
pass through the virtual machine, the VM can monitor and control any opera-
tions performed by the program.


The distinction between bytecode and regular processor binary code has
slightly blurred during the past few years. Several companies have been
developing bytecode processors that can natively run bytecode languages,
which were previously only supported on virtual machines. In Java, for
example, there are companies such as Imsys and aJile that offer “direct
execution processors” that directly execute the Java bytecode without the use
of a virtual machine.

Interpreters

The original approach for implementing virtual machines has been to use
interpreters. Interpreters are programs that read a program’s bytecode exe-


Low-Level Software 61
Free download pdf