HPS Emulation

[18568]

When a file is sent for remote emulation to our Sandblast Appliance (100X), one file is emulated twice on the same Platform, but one of the VM with the status description "HPS emulation must be exclusive".

For example below the same file on same platform Win7, Office 2013, Adobe 11:

The only mention of HPS I can find in all documentation is the following command:

tecli advanced attributes set enable_hps_retry <1|0> = enables (1) or disables (0) HPS retry

Could you please clarify what HPS is?

On a TE100X we can run only 4 VMs, we chose 3 platforms thinking it should be able to run at least all VMs for one file at a time but it is not the case with 2 VMs per platform so the emulation of one file takes quite longer.

[18568]

Nobody knows? 

Dameon Welch-Abernathy‌ or Valeri Loukine would you maybe know about this or know the right person to answer?

Thanks

[_Val_]

We have asked R&D to answer, please stand by

[18568]

Thanks!

[_Val_]

No problem. As far as I understand, HPS is one of the in-depth emulation methods, and it requires exclusive access to CPUs and cannot be performed in parallel with other tasks. Hence that simulation is pending competition of other tasks, as far as I understand.

I still hope R&D can contribute more. 🙂 

[Norbert_Bohusch]

If I remember correctly this are the CPU-level VMs. Thomas Werner should be able to confirm.

[Thomas_Werner · Accepted solution]

HPS refers to "Hyperwise" which was the company name that invented CPUL and which Check Point bought years ago.

So these are the CPU Level emulation instances and yes they count against the maximum number of VMs you can run on an appliance. 

So in case you run a PDF this will be emulated on a traditional VM´s image (e.g. Win7) and the CPUL VM image.

CPUL emulation is always done "exclusively" which means it cannot leverage the multiple file emulation in one VM run which we can do on traditional emulations.

In case a SandBlast appliance is experiencing an emulation queue another feature kicks in which is called "Emulation Mode". It can be set via tecli:

[Expert@R8020SA:0]# tecli adv attr set emulation_mode
Command: root->advanced->attributes->set->emulation_mode
error: command missing the value ("legacy", "experimental", "aggressive", "balanced" or "balancedallsupported")

Default is Balanced which means in case of emulation queue that documents will only be run in CPUL instance and other files only on traditiional instance. "Aggressive" would mean more load by using the default behavior of emulating all files in both instances (remember CPUL is currently only supported for documents; we are working on EXE support).

You could also switch of CPUL emulations completely by:

[Expert@R8020SA:0]# tecli adv attr set enable_cpu_level_detection
Command: root->advanced->attributes->set->enable_cpu_level_detection
error: command missing the enable / disable value (1 / 0)

Regards Thomas