8 ms·

Driver hack lets you run Linux after Windows BSODs, no reboot required

127 points by dragonbonheur 3y ago

lightedman 3y ago
"It would seem that either it wasn't possible to run a full Linux distro, or it was simply too much of a hassle to get it to work" If it could get that far, getting an older DSL distro or similar is probably not that far behind, honestly. Using a BSoD as an environment bootstrap mechanism is hilariously jank, but I've seen worse in my hacking days.
Retr0id 3y ago
> While this driver is more or less just a funny joke about Windows and Linux, it does bring up the possibility of doing more with the same bug check callback feature. It's not clear what you can and can't do, but if it's possible to run an emulator after crashing, then surely it's possible to do other things, too. That's all assuming Microsoft doesn't revisit this feature of Windows and concludes it's just a bit too easy to exploit. Anyone else getting ChatGPT vibes from this conclusion?
- hhh 3y ago
  No, but I can see why you’re seeing it. The “It’s not clear”, “While this”, and similar are common starts in GPT3/4 replies. There’s enough stuff in the later half of the sentences that don’t feel GPT-y to me.
  - robertlagrant 3y ago
    They might've started with GPT and edited.
  - globular-toast 3y ago
    Where do you think ChatGPT learnt it from? I can see people having to get ChatGPT to write stuff for them to make sure what they wrote didn't accidentally look like what ChatGPT would have written. Then the weird feedback loops start...
    - deleted 3y ago
      [deleted]
- deleted 3y ago
  [deleted]
- bil7 3y ago
  Not enough "it's important to consider"
  - litenboll 3y ago
    Or "Ultimately, ..."
- joe_guy 3y ago
  What a strange conclusion for the author to reach. What they're doing requires you to have code execution in the kernel. You're not just over the walls at that point, you've beheaded the king.
onetimeuse92304 3y ago
Now we need to have a linux driver that lets run Windows after kernel panic and we can switch between them without reboot, just like we wanted 20 years ago...
- bdhcuidbebe 3y ago
  its called kvm and is just 2 years shy of turning 20
  - weinzierl 3y ago
    Nah, it's call loadlin and so old that no one seems to remember its birth.
    - meepmorp 3y ago
      I remember loadlin. Netware used to boot that way, too - load DOS, then replace everything.
      - wannacboatmovie 3y ago
        I vaguely remember you could exit NetWare and it would drop you back at the DOS prompt. Do I remember this correctly?
        meepmorp 3y ago
        It's been a while but I don't remember that, under 3.x at least. However, according to Wikipedia: > NetWare 286 2.x normally requires a dedicated PC to act as the server, where the server uses DOS only as a to execute the operating system file NET$OS.EXE. All memory is allocated to NetWare; no DOS ran on the server. However, a "non-dedicated" version was also available for price-conscious customers. In this, DOS 3.3 or higher remains in memory, and the processor time-slices between the DOS and NetWare programs, allowing the server computer to be used simultaneously as a network file server and as a user workstation. Because all (RAM above 1 MiB) is allocated to NetWare, DOS is limited to only 640 KiB; managers that used the MMU of 80386 and higher processors, such as EMM386, do not work; 8086-style expanded memory on dedicated plug-in cards is possible however. Time slicing is accomplished using the keyboard interrupt, which requires strict compliance with the IBM PC design model, otherwise performance is affected. So, maybe that's what you're thinking of? Also, time slicing via keyboard interrupt is something.
perlgeek 3y ago
With 400 lines, it's probably more of a shell / terminal emulator than a Linux emulator.
- _flux 3y ago
  It does emulate risc-v that runs Linux, so why not call it a Linux emulator? Though https://github.com/cnlohr/mini-rv32ima https://github.com/cnlohr/mini-rv32ima is indeed impressively small. Here's the dispatch switch-case: https://github.com/cnlohr/mini-rv32ima/blob/eeeaaa0609558c841088c23e44707a1cb6a14879/mini-rv32ima/mini-rv32ima.h#L171 https://github.com/cnlohr/mini-rv32ima/blob/eeeaaa0609558c84...
  - davrosthedalek 3y ago
    Because it doesn't emulate linux? It emulates risc-v. A game boy emulator doesn't emulate what ever game you play. It emulates the hardware.
FergusArgyll 3y ago
How do you emulate linux with 400 loc?
- Retr0id 3y ago
  You don't emulate linux, you emulate a rv32ima system that happens to boot a linux firmware.
molticrystal 3y ago
> it does bring up the possibility of doing more with the same bug check callback feature. Personally I would just want a power off that does not make me guess if will cause the raid volumes to need to rebuild. But since we are in the realm of possibilities and wishlists, Magic SysRq commands for the windows kernel would rank fairly high. [0] [0] https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html https://www.kernel.org/doc/html/latest/admin-guide/sysrq.htm...
avidphantasm 3y ago
This wins the award for most elaborate boot loader.
pjc50 3y ago
Not really an exploit if you have to have Test Mode turned on. https://learn.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
- fluoridation 3y ago
  The hack is not how the driver is loaded, the hack is how the driver abuses the bug check callback pointer.
- skrebbel 3y ago
  Nobody says it’s an exploit
bitwize 3y ago
Drat, I was hoping for a chainload of the Linux kernel. A sort of "here's a quarter, kid, go get yourself a real operating system" option.
jpl56 3y ago
Would it be possible to save open files with this, so that you don't lose your work after a BSOD?
- Karellen 3y ago
  Well, that would depend on whether the code leading up to the BSOD scrambled the memory of how your disks are laid out or not. It would be ironic if trying to save the files you were currently working on overwrote your partition table or filesystem superblock(s) so you were no longer able to access any of your files any more.
  - jpl56 3y ago
    Good point! It would have to save the files with another filename... or propose a UI to tell which programs were open, so that you can take note of what you were doing
MenhirMike 3y ago
Somewhat related, there was a Laptop that could quick switch between Windows and Linux by abusing ACPI Sleep Support and rewiring the return vectors for the wake-up: https://www.youtube.com/watch?v=q5M0TwnkWUM https://www.youtube.com/watch?v=q5M0TwnkWUM (technical explanation starts at around 48:10) It's all kinds of "I don't approve of the idea, but I tip my hat to the engineer that came up with it for sheer ingenuity."
- deleted 3y ago
  [deleted]
- bmacho 3y ago
  tl;dw: It reserves half the RAM only to keep a sleeping windows/linux there.
FooBarBizBazz 3y ago
Once upon a time, there was a more serious effort at running Linux in a Windows device driver. It was called coLinux: http://www.colinux.org/ http://www.colinux.org/ You could run the Cygwin X server on the Windows side, and run X clients on the Linux side. It worked, and it was fast. I think it required a lot of work whenever a new Linux kernel came out to put the appropriate "yield" code in, so probably maintenance was abandoned? The last update on the homepage is a decade old. I wonder if it still works? It's all been made obsolete though by WSL, I reckon.
- planede 3y ago
  It was basically the same idea as WSL1, i.e. running the Linux kernel (or equivalent) in Windows userspace. It actually worked decently when I tried it back then.
  - Aaron2222 3y ago
    WSL1 implemented Linux syscalls inside the NT kernel (not in userspace).
ang_cire 3y ago
This reminds me of using crashes in PSP games to run homebrew apps.
- dd_xplore 3y ago
  I had a PSP Go, The trick was to crash a certain game by loading a compromised save game file. Wonderful times.
phendrenad2 3y ago
Now this is the kind of crazy stuff I come to HN for.
huxflux 3y ago
Devs website: https://nsg650.github.io https://nsg650.github.io "I am a random 16 year old who likes messing with computers." Things like this give me hope for the future!

127 points by dragonbonheur 3y ago

"It would seem that either it wasn't possible to run a full Linux distro, or it was simply too much of a hassle to get it to work" If it could get that far, getting an older DSL distro or similar is probably not that far behind, honestly. Using a BSoD as an environment bootstrap mechanism is hilariously jank, but I've seen worse in my hacking days.

Retr0id 3y ago

> While this driver is more or less just a funny joke about Windows and Linux, it does bring up the possibility of doing more with the same bug check callback feature. It's not clear what you can and can't do, but if it's possible to run an emulator after crashing, then surely it's possible to do other things, too. That's all assuming Microsoft doesn't revisit this feature of Windows and concludes it's just a bit too easy to exploit. Anyone else getting ChatGPT vibes from this conclusion?

hhh 3y ago
No, but I can see why you’re seeing it. The “It’s not clear”, “While this”, and similar are common starts in GPT3/4 replies. There’s enough stuff in the later half of the sentences that don’t feel GPT-y to me.
- robertlagrant 3y ago
  They might've started with GPT and edited.
- globular-toast 3y ago
  Where do you think ChatGPT learnt it from? I can see people having to get ChatGPT to write stuff for them to make sure what they wrote didn't accidentally look like what ChatGPT would have written. Then the weird feedback loops start...
  - deleted 3y ago
    [deleted]
deleted 3y ago
[deleted]
bil7 3y ago
Not enough "it's important to consider"
- litenboll 3y ago
  Or "Ultimately, ..."
joe_guy 3y ago
What a strange conclusion for the author to reach. What they're doing requires you to have code execution in the kernel. You're not just over the walls at that point, you've beheaded the king.

onetimeuse92304 3y ago

Now we need to have a linux driver that lets run Windows after kernel panic and we can switch between them without reboot, just like we wanted 20 years ago...

bdhcuidbebe 3y ago
its called kvm and is just 2 years shy of turning 20
- weinzierl 3y ago
  Nah, it's call loadlin and so old that no one seems to remember its birth.
  - meepmorp 3y ago
    I remember loadlin. Netware used to boot that way, too - load DOS, then replace everything.
    - wannacboatmovie 3y ago
      I vaguely remember you could exit NetWare and it would drop you back at the DOS prompt. Do I remember this correctly?
      - meepmorp 3y ago
        It's been a while but I don't remember that, under 3.x at least. However, according to Wikipedia: > NetWare 286 2.x normally requires a dedicated PC to act as the server, where the server uses DOS only as a to execute the operating system file NET$OS.EXE. All memory is allocated to NetWare; no DOS ran on the server. However, a "non-dedicated" version was also available for price-conscious customers. In this, DOS 3.3 or higher remains in memory, and the processor time-slices between the DOS and NetWare programs, allowing the server computer to be used simultaneously as a network file server and as a user workstation. Because all (RAM above 1 MiB) is allocated to NetWare, DOS is limited to only 640 KiB; managers that used the MMU of 80386 and higher processors, such as EMM386, do not work; 8086-style expanded memory on dedicated plug-in cards is possible however. Time slicing is accomplished using the keyboard interrupt, which requires strict compliance with the IBM PC design model, otherwise performance is affected. So, maybe that's what you're thinking of? Also, time slicing via keyboard interrupt is something.

perlgeek 3y ago

With 400 lines, it's probably more of a shell / terminal emulator than a Linux emulator.

_flux 3y ago
It does emulate risc-v that runs Linux, so why not call it a Linux emulator? Though https://github.com/cnlohr/mini-rv32ima https://github.com/cnlohr/mini-rv32ima is indeed impressively small. Here's the dispatch switch-case: https://github.com/cnlohr/mini-rv32ima/blob/eeeaaa0609558c841088c23e44707a1cb6a14879/mini-rv32ima/mini-rv32ima.h#L171 https://github.com/cnlohr/mini-rv32ima/blob/eeeaaa0609558c84...
- davrosthedalek 3y ago
  Because it doesn't emulate linux? It emulates risc-v. A game boy emulator doesn't emulate what ever game you play. It emulates the hardware.

FergusArgyll 3y ago

How do you emulate linux with 400 loc?

Retr0id 3y ago
You don't emulate linux, you emulate a rv32ima system that happens to boot a linux firmware.

molticrystal 3y ago

> it does bring up the possibility of doing more with the same bug check callback feature. Personally I would just want a power off that does not make me guess if will cause the raid volumes to need to rebuild. But since we are in the realm of possibilities and wishlists, Magic SysRq commands for the windows kernel would rank fairly high. [0] [0] https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html https://www.kernel.org/doc/html/latest/admin-guide/sysrq.htm...

avidphantasm 3y ago

This wins the award for most elaborate boot loader.

pjc50 3y ago

Not really an exploit if you have to have Test Mode turned on. https://learn.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option https://learn.microsoft.com/en-us/windows-hardware/drivers/i...

fluoridation 3y ago
The hack is not how the driver is loaded, the hack is how the driver abuses the bug check callback pointer.
skrebbel 3y ago
Nobody says it’s an exploit

bitwize 3y ago

Drat, I was hoping for a chainload of the Linux kernel. A sort of "here's a quarter, kid, go get yourself a real operating system" option.

jpl56 3y ago

Would it be possible to save open files with this, so that you don't lose your work after a BSOD?

Karellen 3y ago
Well, that would depend on whether the code leading up to the BSOD scrambled the memory of how your disks are laid out or not. It would be ironic if trying to save the files you were currently working on overwrote your partition table or filesystem superblock(s) so you were no longer able to access any of your files any more.
- jpl56 3y ago
  Good point! It would have to save the files with another filename... or propose a UI to tell which programs were open, so that you can take note of what you were doing

MenhirMike 3y ago

Somewhat related, there was a Laptop that could quick switch between Windows and Linux by abusing ACPI Sleep Support and rewiring the return vectors for the wake-up: https://www.youtube.com/watch?v=q5M0TwnkWUM https://www.youtube.com/watch?v=q5M0TwnkWUM (technical explanation starts at around 48:10) It's all kinds of "I don't approve of the idea, but I tip my hat to the engineer that came up with it for sheer ingenuity."

deleted 3y ago
[deleted]
bmacho 3y ago
tl;dw: It reserves half the RAM only to keep a sleeping windows/linux there.

FooBarBizBazz 3y ago

Once upon a time, there was a more serious effort at running Linux in a Windows device driver. It was called coLinux: http://www.colinux.org/ http://www.colinux.org/ You could run the Cygwin X server on the Windows side, and run X clients on the Linux side. It worked, and it was fast. I think it required a lot of work whenever a new Linux kernel came out to put the appropriate "yield" code in, so probably maintenance was abandoned? The last update on the homepage is a decade old. I wonder if it still works? It's all been made obsolete though by WSL, I reckon.

planede 3y ago
It was basically the same idea as WSL1, i.e. running the Linux kernel (or equivalent) in Windows userspace. It actually worked decently when I tried it back then.
- Aaron2222 3y ago
  WSL1 implemented Linux syscalls inside the NT kernel (not in userspace).

ang_cire 3y ago

This reminds me of using crashes in PSP games to run homebrew apps.

dd_xplore 3y ago
I had a PSP Go, The trick was to crash a certain game by loading a compromised save game file. Wonderful times.

phendrenad2 3y ago

Now this is the kind of crazy stuff I come to HN for.

huxflux 3y ago

Devs website: https://nsg650.github.io https://nsg650.github.io "I am a random 16 year old who likes messing with computers." Things like this give me hope for the future!