应用程序的沙箱虚拟机（概念）
我想编写一个沙箱虚拟机来执行已编译的程序。我的目标是将该程序与操作系统的其余部分隔离并控制其执行，以便它不会对主机做出任何有害的事情。
我假设：
- 执行的程序被编译为可移植可执行格式，并且是机器代码，而不是任何类型的字节代码或 CLR，
- 执行的程序不允许与打印机、扫描仪等外围设备通信，并且不使用任何 GUI ，
- 执行程序的主要任务是处理本地文件中存储的一些数据（例如计算），并将其结果放入另一个本地文件中，
- 执行程序不应该能够直接与操作系统通信，每个请求都应该被处理对于虚拟机来说，任何可能对操作系统造成损害的请求都应该被阻止。
我对沙箱虚拟机的架构和操作的概念：
- 应用程序由几个模拟的对象组成：处理器，内存，文件的I/O操作，
- 有一个模块读取编译后的文件并将可执行代码加载到虚拟内存，
- 然后是虚拟处理器从第一个字节开始处理，读取操作码、参数，如果需要的话从内存加载它们，执行命令并将结果放在适当的位置，如果需要设置虚拟标志，然后读取下一个命令，直到程序执行到最后。
您觉得怎么样：这是一个好概念吗？你会改变什么来改进它？
I'd like to write a sandbox virtual machine for executing a compiled program. My goal is to isolate that program from the rest of operating system and control its execution so that it can't do anything harmful to a host computer.
I assume that:
- executed program is compiled to Portable Executable format and it's in machine code, not in any kind of byte code or for CLR,
- executed program is not allowed to communicate with peripherals like printer, scanner, and doesn't use any GUI,
- executed program's main task is to process some data stored in a local file (eg. calculations), and put its results in another local file,
- executed program shouldn't be able to communicate directly with an operating system, every request should be handled by a virtual machine, any request that may cause damage to an operating system should be blocked.
My concept of sandbox virtual machine's architecture and operation:
- application consists of several objects that simulate: processor, memory, i/o operations on files,
- there is a module that reads compiled file and loads executable code to a virtual memory,
- then the virtual processor starts processing from the first byte, reads opcode, arguments, loads them from memory if needed, executes command and puts the result in appropriate place, sets virtual flags if needed, then reads the next command, until the program is executed to the end.
What do you think: is it a good concept? What would you change to improve it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
模拟完整的机器似乎是执行本机代码的一种非常慢的方法。仅针对单个本机指令进行大量加载、查找、执行、存储等操作。
我会尝试本地执行至少一些代码块。想想下面的代码。
该代码可以完全安全地在虚拟机中本地执行。只需确保向虚拟机代码注入返回调用即可。
但我会尝试更进一步，本地执行除库/操作系统调用之外的所有代码。在加载沙盒应用程序之前，扫描文件并将所有“危险”调用替换为对虚拟机中处理程序的调用。
该代码
将被替换为对您的库的调用
然后您可以以本机速度执行整个程序，并且仍然能够处理虚拟机中的所有危险代码。
Simulating a complete machine seems like a very slow way to execute native code. Lots of operations with load, lookup, execute, store, etc just for a single native instruction.
I would try to execute at least some blocks of code natively. Think of the following code.
This code is completely safe to execute native in your virtual machine. Just make sure that you inject a return call to your virtual machine code.
But I would try to go a step further and execute all code natively except for library/os calls. Before loading the sandboxed application, scan through the file and replace all "dangerous" calls with calls to handlers in your virtual machine.
The code
would be replaced with calls to your library
Then you can execute the whole program at native speed and still be able to handle all the dangerous code in your virtual machine.
只需调整进程的权限，您就可以实现很多目标。至少在WinNT下，它有相当细粒度的进程权限。我还相信 Chrome 中使用的谷歌沙箱已经开源。
Just by adjusting process's rights, you can achieve A LOT. At least under WinNT, which has rather fine-grained process rights. I also believe that google's sandboxing, used in Chrome, has been opensourced.
听起来这可以通过现有的沙箱（例如 SELinux 或 App-V 由微软提供。
访问外围设备也可能会出现问题。如果外围设备是房间内的摄像头或麦克风怎么办？如果黑客想通过用彩虹文本打印一个永无止境的故事来浪费你的钱怎么办？
This sounds like this can be accomplished with existing sand-boxing such as SELinux or App-V by Microsoft.
Also access to peripherals can be problematic. What if the peripheral is a camera in the room or a microphone? What if the hacker wants to waste your money by printing out a never ending story in rainbow text?