vm-interpreter
Exploiting custom interpreters and virtual machines
When & Why to Use This Skill
This Claude skill provides a comprehensive methodology for identifying and exploiting vulnerabilities in custom virtual machines (VMs) and interpreters. It guides users through the process of transforming restricted VM semantics into powerful arbitrary memory read and write primitives, facilitating the analysis of memory layouts, pointer manipulation, and the bypassing of security boundaries in sandboxed environments.
Use Cases
- CTF (Capture The Flag) Competitions: Solving complex 'pwn' challenges that involve custom bytecode executors or esoteric language interpreters.
- Vulnerability Research: Auditing proprietary or custom-built VMs used for software obfuscation or sandboxing to identify potential escape vectors.
- Security Auditing: Identifying memory safety issues in applications that implement internal scripting engines or domain-specific languages (DSLs).
- Exploit Development: Converting restricted execution environments into full system compromises by overwriting Global Offset Table (GOT) entries or return addresses.
- Reverse Engineering: Analyzing how custom interpreters manage memory and mapping the relationship between VM memory and the host process's address space.
| name | vm-interpreter |
|---|---|
| description | Exploiting custom interpreters and virtual machines |
VM/Interpreter Exploitation
Concept: Turn VM semantics into arbitrary read/write primitives.
Recognition
Signals:
- Custom interpreter for small language
- Brainfuck-like instructions (
>,<,+,-,.,,) - Bytecode VM with opcodes manipulating memory
- Memory tape/array with movable pointer
Goal
Convert VM operations into:
- Arbitrary read: Leak addresses, secrets
- Arbitrary write: Modify GOT, return addresses, pointers
Analysis Steps
1. Map memory layout:
Where does VM memory live?
- Stack (near return addresses)
- Heap (near malloc metadata)
- BSS/data (near GOT, globals)
2. Find neighbors:
What's adjacent to VM memory?
- GOT entries
- Function pointers
- Stack frames
- Global variables
3. Calculate distances:
distance = target_addr - vm_memory_base
moves = distance / pointer_step_size
Common VM Types
Brainfuck-style:
| Op | Effect |
|---|---|
> |
Move pointer right |
< |
Move pointer left |
+ |
Increment byte |
- |
Decrement byte |
. |
Output byte |
, |
Input byte |
Bytecode style:
- LOAD, STORE - Memory access
- ADD, SUB - Arithmetic
- JMP, JZ - Control flow
- PUSH, POP - Stack operations
Exploitation Patterns
Pattern A - Leak via output:
1. Calculate distance from VM memory to target
2. Move pointer to target location
3. Output bytes at pointer
4. Reconstruct leaked address
Pattern B - GOT/pointer overwrite:
1. Move pointer to writable target
2. Set bytes to desired value
3. Trigger overwritten function
Pattern C - Return address overwrite:
(Only if VM memory is on stack)
1. Find offset to saved return address
2. Navigate and overwrite
Pitfalls
| Issue | Solution |
|---|---|
| Off-by-one navigation | Verify with known values first |
| Endianness | x86 is little-endian |
| Character restrictions | Use loops for encoding |
| Instruction limits | Optimize, use loops |
| Null bytes in target | Write in pieces |