WASM in the Kernel: evolving threat detection at runtime
summary
Mimic runs WebAssembly in the Windows kernel to deploy live security patches, extend telemetry, and inject logic without reboots, using the WebAssembly Component Model and a signed minifilter driver. The team chooses Wasmtime/Pulley and interprets WASM (no JIT) to satisfy signing/no-std constraints, compiles components ahead‑of‑time to a pulley binary, implements custom TLS and panic/SEH handling, and coordinates host WIT imports. The system works end‑to‑end (file deletion and registry‑blocking demos succeed) but interpretation causes measurable performance costs.
AI-written summary · about
chapters (17)
- 0:00WASM in the kernel intro
- 1:45Kernel programming challenges
- 3:32Why WebAssembly over eBPF
- 4:38WASM kernel limitations
- 6:49Wasmtime for Windows kernel
- 8:17Wasmtime no_std patching
- 8:58IRQL handling in Windows
- 9:41Host functions and errors
- 10:24Wasmtime sync fixes
- 11:30TLS and component deployment
- 12:33Sandboxing vs static verification
- 13:37Demo setup
- 14:21File system demo
- 18:01Registry operations demo
- 23:06Blocking profanity in registry
- 24:54Crashing system last resort
- 26:44Q&A
related talks
53mWebAssembly
36mSafety-Critical Meets Web-Native: Wasm Revolutionizes Embedded Systems
53mWASM Wonders Decoding WebAssembly's Inner Workings
48mDon't Trust Anything! Real-world Uses For WebAssembly
40mSmarter Operating Systems Will Use Wasm - The Coming OS Revolution
53mUsing WebAssembly to run, extend, and secure your .NET application
30mDemystifying the WASM Landscape: A Primer
50mWeb Assembly