Bats Can No Longer Haunt Apple VR Headsets Via Web Exploit

June 26, 2024 by Donald Papp 33 Comments

Bug reporting doesn’t usually have a lot of visuals. Not so with the visionOS bug [Ryan Pickren] found, which fills a user’s area with screeching bats after visiting a malicious website. Even better, closing the browser doesn’t get rid of them! Better still? Doesn’t need to be bats, it could be spiders. Fun!

The bug has been fixed, but here’s how it worked: the Safari browser build for visionOS allowed a malicious website to fill the user’s 3D space with animated objects without interaction or permission. The code to trigger this is remarkably succinct, and is actually a new twist on an old feature: Apple AR Quick Look, an HTML-based feature for rendering 3D augmented reality content in Safari.

Leveraging this old feature is what lets an untrusted website launch an arbitrary number of animated 3D objects — complete with sound — into a user’s virtual space without any interaction from the user whatsoever. The icing on the cake is that Quick Look is a separate process, so closing Safari doesn’t get rid of the pests.

Providing immersive 3D via a web browser is a valuable way to deliver interactive content on both desktops and VR headsets; a good example is the fantastic virtual BBC Micro which uses WebXR. But on the Apple Vision Pro the user is always involved and there are privacy boundaries that corral such content. Things being launched into a user’s space in an interaction-free way is certainly not intended behavior.

The final interesting bit about this bug (or loophole) was that in a way, it defied easy classification and highlights a new sort of issue. While it seems obvious from a user experience and interface perspective that a random website spawning screeching crawlies into one’s personal space is not ideal, is this a denial-of-service issue? A privilege escalation that technically isn’t? It’s certainly unexpected behavior, but that doesn’t really capture the potential psychological impact such bugs can have. Perhaps the invasion of personal space and user boundaries will become a quantifiable aspect of bugs in these new platforms. What fun.

Kernel Hack Brings Windows XP To The 486

June 23, 2024 by Alexander Rowsell 20 Comments

The venerable Intel 486 was released in 1989 as the successor to the extremely popular Intel 386. It was the minimum recommended processor for Windows 98. (Surprisingly, the Windows 95 minimum was a 386!) But by the time XP rolled around, you needed at least a 233 MHz Pentium to install. Or at least that was the case until recently when an extremely dedicated user on MSFN named [Dietmar] showed how he hacked the XP kernel so it could run on the classic chip!

The biggest issue preventing XP from working on earlier processors is an instruction introduced on the Pentium: CMPXCHG8B. This instruction compares two 8-byte values and takes different actions depending on an equality test. It either copies the 8 bytes to a destination address or loads it into a 64-bit register. Essentially, it does what it says on the tin: it CoMPares and eXCHanGes some values. If you want to dig into the nitty-gritty details, you can check out this info on the instruction taken from the x86 datasheet.

Without getting too technical, know that this instruction is vital for performance when working with large data structures. This is because one instruction moves 8 bytes at a time, unlike the older CMPXCHG instruction, which only moves a single byte. Essentially, [Dietmar] had to find every usage of CMPXCHG8B and replace it with an equivalent series of CMPXCHG instructions.

On a side note, the once well-known and devastating Pentium F00F bug was caused by a faulty encoding of the CMPXCHG8B instruction. This allowed any user, even unprivileged users, to completely lock up a system, requiring a full reset cycle!

So [Dietmar] was successful, and now you can run the German version of Windows XP on either a real 486 or an emulated one. The installer is available on the Internet Archive and there’s a detailed video below demonstrating installing it on the 86Box virtual machine host.

Continue reading “Kernel Hack Brings Windows XP To The 486” →

Preview Markdown In The Terminal With Bash

June 17, 2024 by Tom Nardi 12 Comments

Markdown has become an extremely popular way to document source code and other projects, thanks in no small part to how well web-based services like GitHub render it. Just sprinkle a few extra characters into a regular text file, and all of a sudden it looks like you know what you’re doing. Unfortunately, there are some places where markdown won’t actually render, and you’ll be stuck looking at those extra characters.

But thanks to MarCLIdown, the terminal doesn’t have to be one of those places. Written by [NihaAlGhul], this simple tool takes a given markdown file and spits out a fairly impressive rendering — and you don’t even need to have one of those fancy new GPU-accelerated terminals. Most impressively, the whole thing is implemented as a single Bash script.

Continue reading “Preview Markdown In The Terminal With Bash” →

Easy Retro 3D Look With Voxel Displacement Renderer

June 14, 2024 by Maya Posch 9 Comments

Voxels are effectively like 3D pixels, and they form an integral part of what is commonly referred to as a ‘retro 3D’ look, with pixelated edges sharp enough to cut your retinas on. The problems with modeling a scene using voxels come in the form of creating the geometry and somehow making a physics engine work with voxels rather than conventional triangular (or quad) meshes.

The same scene in Blender (above) and in the voxel-based renderer (below). (Credit: Daniel Schroeder)

The approach demonstrated by [Daniel Schroeder] comes in the form of a Voxel Displacement Renderer implemented in C++ and using the Vulkan API. Best part of it? It only requires standard meshes along with albedo and displacement maps.

These inputs are processed by the C++-based tools, which generate the voxels that should be rendered and their properties, while the GLSL-based shader handles the GPU-based rendering step. The pre-processing steps required make it a good idea to bake these resources rather than try to process it in real-time. With that done, [Daniel]’s demo was able to sustain a solid 100+ FPS on a Radeon RX 5700 XT GPU at 1440p, and 60+ FPS on a Steam Deck OLED.

In a second blog post [Daniel] goes through his motivations for this project, with it originally having been intended as a showpiece for his resume, but he can imagine it being integrated into a game engine.

There are still questions to be resolved, such as how to integrate this technique for in-scene characters and other dynamic elements (i.e. non-static scenery), but in terms of easing voxel-based rendering by supporting a standard mesh-based workflow it’s an intriguing demonstration.

Continue reading “Easy Retro 3D Look With Voxel Displacement Renderer” →

A Guide To Running Your First Docker Container

June 10, 2024 by Bryan Cockfield 21 Comments

While most of us have likely spun up a virtual machine (VM) for one reason or another, venturing into the world of containerization with software like Docker is a little trickier. While the tools Docker provides are powerful, maintain many of the benefits of virtualization, and don’t use as many system resources as a VM, it can be harder to get the hang of setting up and maintaining containers than it generally is to run a few virtual machines. If you’ve been hesitant to try it out, this guide to getting a Docker container up and running is worth a look.

The guide goes over the basics of how Docker works to share system resources between containers, including some discussion on the difference between images and containers, where containers can store files on the host system, and how they use networking resources. From there the guide touches on installing Docker within a Debian Linux system. But where it really shines is demonstrating how to use Docker Compose to configure a container and get it running. Docker Compose is a file that configures a number of containers and their options, making it easy to deploy those containers to other machines fairly straightforward, and understanding it is key to making your experience learning Docker a smooth one.

While the guide goes through setting up a self-hosted document management program called Paperless, it’s pretty easy to expand this to other services you might want to host on your own as well. For example, the DNS-level ad-blocking software Pi-Hole which is generally run on a Raspberry Pi can be containerized and run on a computer or server you might already have in your home, freeing up your Pi to do other things. And although it’s a little more involved you can always build your own containers too as our own [Ben James] discussed back in 2018.

Make Your Code Slower With Multithreading

June 7, 2024 by Dave Rowntree 51 Comments

With the performance of modern CPU cores plateauing recently, the main performance gains are with multiple cores and multithreaded applications. Typically, a fast GPU is only so mind-bogglingly quick because thousands of cores operate in parallel on the same set of tasks. So, it would seem prudent for our applications to try to code in a multithreaded fashion to take advantage of this parallelism. Or so it would seem, but as [Marc Brooker] illustrates, it’s not as simple as one would assume, and it’s very easy to end up with far worse overall performance and no easy way to fix it.

[Marc] was rerunning an old experiment to calculate the expected number of birthdays in a shared group of people using brute force. The experiment was essentially a tight loop running a pseudorandom number generator, the standard libc rand() function. [Marc] profiled the code for single-thread and multithreaded versions and noted the runtime dramatically increased beyond two threads. Something fishy was going on. Running perf, [Marc] noted that there were significant L1 cache misses, but the real killer for performance was the increase in expensive context switches. Perf indicated that for four threads, the was an overhead of nearly 50% servicing spin locks. There were no locks in the code, so after more perf magic, the syscalls taking all the time were identified. Something in there was using a futex (or fast userspace mutex) a whole lot.

Continue reading “Make Your Code Slower With Multithreading” →

Feast Your Eyes On These AI-Generated Sounds

May 28, 2024 by Tom Nardi 7 Comments

The radio hackers in the audience will be familiar with a spectrogram display, but for the uninitiated, it’s basically a visual representation of how a range of frequencies are changing with time. Usually such a display is used to identify a clear transmission in a sea of noise, but with the right software, it’s possible to generate a signal that shows up as text or an image when viewed as a spectrogram. Musicians even occasionally use the technique to hide images in their songs. Unfortunately, the audio side of such a trick generally sounds like gibberish to human ears.

Or at least, it used to. Students from the University of Michigan have found a way to use diffusion models to not only create a spectrogram image for a given prompt, but to do it with audio that actually makes sense given what the image shows. So for example if you asked for a spectrogram of a race car, you might get an audio track that sounds like a revving engine.

Continue reading “Feast Your Eyes On These AI-Generated Sounds” →