The Linux Kernel Hidden Inside Windows 10
summary
A built-in Ring-0 driver implements a Linux-compatible ABI (not the Linux kernel) that runs unmodified ELF binaries, exposes 216 syscalls, and implements VFS, BSD sockets, ptrace and an ELF loader. The driver (≈800 KB driver) registers as a pico provider, creates pico processes without PEB/TEB, and uses a device-based IPC via /dev/lxss and COM/IOCTLs; many initial visibility and handle issues are fixed but file handles stay kernel-owned and attack surface increases.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:08INTRODUCTION
- 4:55MINIMAL PROCESS
- 6:46PICO PROCESS
- 8:00PICO PROVIDERS
- 10:11PICO PROVIDER SECURITY
- 11:14WSL COMPONENT OVERVIEW
- 17:30SYSTEM CALLS
- 21:42DEVICE OBIECT INTERFACES
- 23:10BUS INSTANCES
- 34:47SOCKETS / FILES
- 37:15BUS IPC MARSHALLING
- 38:35BUS IPC DATA EXCHANGE
- 39:43INITIAL ANALYSIS
- 46:51ATTACK SURFACE ANALYSIS
- 47:50PROCESS / THREAD NOTIFICATIONS & BEHAVIOR
- 50:15CONCLUSION
related talks
01h 02mWriting a Windows Kernel Driver in an hour or two
01h 26mLinux User/Kernel ABI: the realities of how C and C++ programs really talk to the OS
21m(Ab)using Linux as a Trusted Bootloader
48mBooting a Linux Kernel in a Higher Privilege Level
56mWindows Kernel Graphics Driver Attack Surface
25mThe Windows Subsystem for Linux
39mRunning Linux on Tiny Peripherals
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation