Hacker News new | ask | show | jobs
by avianlyric 811 days ago
Historically the justification for limiting the use of JIT compilers is for security reasons, which does actually stack up.

JIT compilers are one of few use cases where an application absolutely needs the ability to write data to memory, mark that memory region as executable, and then execute the op codes in that memory region. On iOS, other than Safari, no application, either built in or installed via the App Store is allowed to change memory permissions from writable to executable, and that acts as a cornerstone in iOS application sandboxing.

Now there’s perfectly good argument that the security argument doesn’t really stack up anymore, given that sandboxing technologies have progressed a lot, and it should be possible to properly sandbox a JIT compiler or similar. But there’s no denying the fact that removing the ability for an application to execute arbitrary created op codes is a very good way to completely eradication a huge surface area for exploits. Especially when such restrictions are paired with static scanning of binaries before signing (which happens when any binary is produced for iOS, via Apples signing service).

All of that is to say, there is a possible world where ROM are transpiled for iOS devices (using something like Rosetta), and loaded as signed binaries via emulation wrappers. But at point you’re basically having to create your own App Store, and sign a new app for each transpiled ROM.

In short, it doesn’t seem likely we’ll see JIT powered emulators on iOS anytime soon, and, at least in this specific instance, Apple has a legitimate security reason for restricting their usage.

1 comments

If Apple is compelled to allow users to run unsigned binaries (like Android) - would that allow for JIT emulators to run or is there something fundamentally blocking the execution of JIT code in iOS that prevents this?
There is no technical limitation, there is even an API for doing so.

It's just that apple block any submissions using that API from the app store.

iOS itself almost certainly also blocks usages of that API as well, unless the binary is signed with the correct entitlements.

But if Apple was forced to allow any binary to execute, and utilise any entitlement/API, then yeah there’s nothing stopping a JIT emulator running on iOS. But I think it’s very unlikely the EU would go that far, I don’t think such actions are needed for the EU to achieve their aims (liberalisation of app economy and markets).