Is JauntePE an Application Virtualization???

Message

crownixx · #1 Post by **crownixx** » Sat Nov 29, 2008 2:17 am

Is JauntePE an Application Virtualization? i cant tell the absolute answer but i bring few evidences to share here. Let's try comparing JauntePE with the well known application virtualization in the market, Thinapp/Thinstall

Objective

Thinstall Objective
VMware ThinApp is an application virtualization solution. As with similar products from other vendors, it is able to execute applications without them being installed in the traditional sense by virtualizing resources such as environment variables, files and Windows Registry keys. The virtual environment presented to the client is a merged view of the underlying physical and virtual resources, thereby allowing the virtualization layer to fool the application into thinking that it is running as if it were fully installed. (Source: Wikipedia: VMware Thinapp )

JauntePE Objective
JauntePE is a simple utility that is designed to help you attempt to run non-portable applications in a portable manner. Its two main features are the redirection of registry modifications into a portable registry file and the redirection of special directory file system modifications into equivalent portable directories. Both of these options are available on a per-application basis, so it's possible to create completely stand-alone portable "packs" of otherwise non-portable applications. JauntePE accomplishs the "portablization" of applications through the use of the MadCodeHook dll injecting and api-hooking runtime library. (Source: 0.1.* Readme.txt)

Working principle

Thinstall working principle
Thinstall emulates and translates the Win32 API on a more selective basis to achieve its stated goals. With Thinstall the vast majority of the Win32 API passes directly to Windows with no emulation or translation.

For an example of how translation is used, when an application tries to write to the file "c:\windows\win.ini" using the CreateFile API Thinstall will translate this call into CreateFile "c:\documents and settings\username\application data\thinstall\appname\%SystemRoot%\win.ini". In this case, most of the functionality for a file system is being provided by Windows.

Thinstall also uses emulation to achieve it's goals, for example it completely emulates the Windows Loader, Windows registry, Services, COM/DCOM, and about 30 other subsystems, rather than passing API calls on to Windows. When an application tries to write to the registry using RegSetValue Thinstall emulates the behavior of the Windows registry and writes the updated registry data to a disk file under %AppData%\Thinstall\registry.rw.tvr.
(Source: Thinapp Blog>Thinstall & Wine)

JauntePE working principle
JauntePE accomplishs the "portablization" of applications through the use of the MadCodeHook dll injecting and api-hooking runtime library. This library allows JauntePE to insert its runtime dll code into the launched application's created process so that JauntePE's runtime code is executed in place of the OS code that would otherwise allow the registry and file system modifications to occur that make the application unportable. The JauntePE runtime then analyzes the requests made and either executes its own code to portablize the request or, if it determines that no unnecessary modification will be made, allows the request to be processed by the OS as normal. (Source: 0.1.* Readme.txt)

By default, once registry and file system redirection is enabled, all of the possible API functions that might be used by an application for registry and file system access are hooked by the JauntePE runtime for possible portablization.

With registry redirection turned on, by default all registry changes are redirected. So the only keys of concern are those that we don't want to have redirected into the portable registry. The portable registry will be save based on user define path in the runtime ini. For example [Registry]Data=.\Data\%appname%.reg

With file system redirection turned on, by default all special folder file system changes are redirected. User can define where these special folder will be directed for example Data=.\Data\Filesystem
(Source: 0.3.0 readme.html)

and more reading about Registry virtualization

Similarly, application virtualization redirects all of an application's Registry operations to a non-Registry backed location, such as a file. Used together with file virtualization, this approach allows applications to run without being installed on the location machine.

(Source: Wikipedia: Windows Registry)

So what's your vote?

rokth · #2 Post by **rokth** » Sat Nov 29, 2008 11:06 am

Did you think to ask Redllar?

crownixx · #3 Post by **crownixx** » Sat Nov 29, 2008 4:45 pm

rokth wrote:Did you think to ask Redllar?

Yes, i cross my mind on that but to make a simple explaination, i quote small parts of his last message

And, as this might be the last communication I have with you, I'd also
just like to say thanks. I've come to view most of the net/web as a
waste of time, but you and a few others like you helped make it a more
bearable place to be for a while.

fawkes · #4 Post by **fawkes** » Wed Dec 03, 2008 5:47 pm

I have to say that it depends on what the difference between emulating the API and hooking the API is, both accomplishes the same thing, but depending on if there is a difference I believe we can say if JauntePE is an Application Virtualization type of software or not. Though I am curious why the person that voted no did so, what was the reason that makes you believe JauntePE is not an Application Virtualization?

m^(2) · #5 Post by **m^(2)** » Thu Dec 04, 2008 1:22 am

fawkes wrote:I have to say that it depends on what the difference between emulating the API and hooking the API is, both accomplishes the same thing, but depending on if there is a difference I believe we can say if JauntePE is an Application Virtualization type of software or not. Though I am curious why the person that voted no did so, what was the reason that makes you believe JauntePE is not an Application Virtualization?

Both applications first hook APIs to be able to emulate it when needed.
No difference in here.

fawkes · #6 Post by **fawkes** » Thu Dec 04, 2008 6:29 pm

So they both work in the same way and do the same thing? Then I can't see why there is even a question of if JauntePE is an Application Virtualization software. I find it weird that someone voted No on the pool. To quote J.W. Riley, "If it walks like a duck and quacks like a duck, I would call it a duck." I would say that pretty much sums up my opinion on this issue.

crownixx · #7 Post by **crownixx** » Fri Dec 05, 2008 3:46 pm

fawkes wrote: Then I can't see why there is even a question of if JauntePE is an Application Virtualization software

The reason my post in question is because i want to avoid people asking me back "Hey buddy, what's your credibility to tell this app is app virtualization? Are you the developer?" See my point?

Of course I'm not the developer, i'm just a big fan of JauntPE.

fawkes wrote: To quote J.W. Riley, "If it walks like a duck and quacks like a duck, I would call it a duck." I would say that pretty much sums up my opinion on this issue.

Well, i'm glad you are also agreeing with my point of view

m^(2) · #8 Post by **m^(2)** » Sun Dec 07, 2008 4:04 pm

I took part in the poll already and I'm not the lonely one who said "no". I admit I did it because of the "it's the same as Thinstall" thought.

However, encouraged by crowinxx, I thought about it somewhat deeper.

Is ThinApp virtualization? It's not that easy to answer as it's significantly lacking in here.
- It can run only 1 OS. Windows.
- Can't virtualize kernel
- Can't virtualize hardware
- (correct?) It doesn't allow to change many important OS information like version, current date etc. Different instances of the same program see themselves (even if configured to use different sandbox)

Considering that what's called OS level virtualization has all these problems (do programs see each other?) as well and is commonly accepted as virtualization, I think that ThinApp is virtualization.

Furthermore:
Are they the same as I stated before?

Here's some interesting information on the topic:

crownixx wrote:JPE only redirect file system special folder usage. Read more in the readme.html>The Runtime Ini>Portablizer>File System

So it seems they are not. ThinApp can redirect all file system usage. They use the same method, but JauntePE is limited to what Redllar considered important. Actually it makes it even less capable as virtualization. Example? You can safely run a program you expect to might be malware in a properly configured Thinstall sandbox. Can you with JauntePE? No. It will prevent the program from autostarting, but not from deleting all your files.

So let's think what features of virtualization does it still have:
- lets you run several instances of the same program with different config. Unless this program checks for already running instance.
- gives you partial independence from the host OS. You can pack libraries that normally require (not too deep) OS integration with your program. Like .NET (Should be possible, right?)
- When only 1 instance is running, you can isolation from the host that's in many cases good enough.

Did I miss something?

Now I think that JauntePE is lacking too much. I'm struggling to say that OS level virtualization is virtualization, but I accept it as it's very common opinion. JauntePE delivers even lower separation between OSes. I think that it's not virtualization.

[OT]
Andy, I found a forum issue: text
I guess that's because of parenthesis.
[/OT]

fawkes · #9 Post by **fawkes** » Sun Dec 07, 2008 5:50 pm

You make some great point, although I have to disagree with you on this. What you say is that since JPE is not made to redirect all filesystem calls then it does not fall in the same category as ThinApp. I believe they both do because they do the same thing and accomplishes it in the same way so both are Application Virtualization software, the difference is the degree of virtualization they can do which now is higher with ThinApp then with JPE. Still the degree of virtualization does not decide if the we can call it application virtualization or not, an example would be that Paint does not have as many possibilities as Photoshop, yet both are considered image editiong tools

crownixx · #10 Post by **crownixx** » Sun Dec 14, 2008 12:43 am

Thanks for the opinion m^(2)

m^(2) wrote:Is ThinApp virtualization? It's not that easy to answer as it's significantly lacking in here.
- It can run only 1 OS. Windows.
- Can't virtualize kernel

My understanding is that we have 2 type of virtualization
1. Application virtualization
2. Operating system virtualization
The 1st paragraph in Wikipedia: Application Virtualization

Application virtualization differs from operating system virtualization in that in the latter case, the whole operating system is virtualized rather than only specific applications.

Your point about Thinapp can't virutalize kernel is true and that is why Thinapp only claiming it is an Application virtualization and not Operating system virtualization.

Go back again, is JauntPE an Application virtualization? I'm trully agree with fawkes.

.That term is right, it is all about degree of virtualization. All i know that JauntePE is proven to use same technique and method that is used by Thinapp and possibly any other Application Virtualization. And yes, JauntePE is lacking some features compared to Thinapp and it never try to be like Thinapp.

m^(2) · #11 Post by **m^(2)** » Sun Dec 14, 2008 1:01 am

crownixx wrote:Thanks for the opinion m^(2)
m^(2) wrote:Is ThinApp virtualization? It's not that easy to answer as it's significantly lacking in here.
- It can run only 1 OS. Windows.
- Can't virtualize kernel
My understanding is that we have 2 type of virtualization
1. Application virtualization
2. Operating system virtualization
The 1st paragraph in Wikipedia: Application Virtualization
Application virtualization differs from operating system virtualization in that in the latter case, the whole operating system is virtualized rather than only specific applications.
Your point about Thinapp can't virutalize kernel is true and that is why Thinapp only claiming it is an Application virtualization and not Operating system virtualization.

Go back again, is JauntPE an Application virtualization? I'm trully agree with fawkes. All i know that JauntePE is proven to use same technique and method that is used by Thinapp and possibly any other Application Virtualization. And yes, JauntePE is lacking some features compared to Thinapp and it never try to be like Thinapp.

It's the first time I hear about application virtualization. You created the wiki page, didn't you?

Sadly, inability to virtualize drivers is a huge limitation here only - many programs can't be virtualized this way (mentioned in the wiki, but I wanted to stress it in here).

While I agree that both JPE and Thinstall fit the wiki definition perfectly, I don't fully agree with the definition itself. Up to it, even Windows compatibility modes can be called virtualization, which totally misses the point.

I think I'd have to think about it some more.

crownixx · #12 Post by **crownixx** » Sun Dec 14, 2008 1:34 am

It's the first time I hear about application virtualization. You created the wiki page, didn't you? Laughing Wink

Lol, of course i'm not. I dont have the the main important thing to be a writer which is strong grammar to write in wiki page

Well, it's good to have a debate like this and it is happen when we dont have clear definition about some term