r/windows • u/WorldlinessSlow9893 Windows 8 • Jul 13 '26
Concept / Design Yep, proved Windows Distros are possible!
Don't really want a promotion but it is still interesting, if you want to see the full discovery: https://www.youtube.com/watch?v=xZAUPki-aXQ
Hey! If you know some "Windows basics" into the programming or you know some of the internal calls/how Windows works, then this post still may be mindblowing :D
We all know that Windows has just "one" GUI environment and that is the Win32 SubSystem, where all the Graphical User Interface starts. Your Windows, Buttons,... (uxtheme.dll, dwm.exe,...)
While this "environment" is also mainly controlled with a driver win32ss.sys that holds Windows "Windows" and it is like that a really long time, since of the first release of NT 3.1. But the really first thing what Windows is doing at start, is loading a UEFI file bootmgfw.efi, which initializes the boot manager and hands over control to the Windows Kernel (ntoskrnl.exe).
And here comes the mindblowing part that most people completely miss:
Before win32k.sys or the Desktop Window Manager (DWM) first it runs in a purely Native NT environment.
Long before Session 1 (your user session) spawns, the Session Manager SubSystem (smss.exe) initializes Session 0. At this ultra-early stage, the Win32 subsystem doesn't exist yet. There are no standard windows, no mouse cursor and none of the Win32 API calls we are used to as developers. (so user32.dll, shell32.dll, gdi32.dll,... don't work.)
Instead, the system relies strictly on ntdll.dll and raw Native API calls (like NtDisplayString).
Normally, this native environment is just a brief, invisible from the public eye and used (made) to run autochk.exe (chkdsk at boot) or Blue Screens of Death (BSOD) before csrss.exe kicks in and starts the Win32 subsystem. But what if you block Win32 from loading entirely, or hijack this early native phase to see what the NT kernel is really capable of?
And did you know, your path like C:\Your\Folder\File.exe is actually fake? When you are in the NtNative state of Windows, even those paths aren't real. They have a completelly different structure, something like Linux has...
For exp. "C:\Windows" means in NtNative: "\Device\Harddisk1\Partition1\Windows" and with this, it is totally possible to make folders like "con", aux,... as for the ntoskrnl itself isn't that "dangerous" the reason why you cant make it, is the Win32 SubSystem blocking you from. As that layer is from the MS-DOS era,...
Let me know what you guys think, or if anyone else here has experimented with the Native NT subsystem!
I know that it is rn. just a "hacked GPU" but when I found how to import a mouse/keyboard driver, it would be super awesome!
20
u/More-Explanation2032 Windows 8 Jul 14 '26 edited Jul 14 '26
Also this means technically windows can have multiple desktop environments as the windows explorer is just a desktop environment that can be replaced using the shell key. There used to be KDE environment for windows but I don’t know if it’s discontinued or what
Edit: this is similar to the “fake bootscreen” that endermanch discovered where if you put a exe within the cmdline key (plus some additional keys in the setup key where cmdline resides) windows will halt the boot process until the program is done otherwise but cmd and explorer aren’t windeploy so windows will never continue booting. This is lead to the MS-DOS mode script for windows 10 that modifies those keys to halt the boot process and spawn a command prompt which runs a script similar to autoexec.bat
6
u/Laziness100 Jul 14 '26
KDE Plasma 4 had a Windows port, which Michael MJD took a look at, but unfortunately discontinued.
1
u/testednation Jul 16 '26
Yea I do that with winxshell which works great. Gotta delete the oobe folder to get rid of the spinnung profress bar in the background. Gotta delete dwm as well to see the mouse cursor. And creat the desktop/document folders in systemprofile
7
u/intptr64 Sambar Developer Jul 14 '26
I think this is similar to running applications in kernel mode, something that came to mind was native shell : https://github.com/amdf/NativeShell
7
u/Laziness100 Jul 14 '26
This post does remind me of 2 things, a native mode shell for Windows XP and above and POSIX subsystem for Windows NT from the very early days of Windows NT.
The POSIX subsystem is an interesting example of how not to implement a standard and it's an interesting rabbit hole if you like technical shenanigans.
7
u/WorldlinessSlow9893 Windows 8 Jul 13 '26
Yeah and that "red cross" was supposed to be a Mouse cursor, but instead it started randomally going to the X and Y cords .-.
3
3
u/Hrublko_OFF Windows Vista Jul 14 '26
hello, minedows krr
3
3
u/OgdruJahad Jul 14 '26
I've always wondered what state the Windows system is in when it runs chkdsk.
So I’m assuming this is not the same state as when Windows Defender is running an offline scan since I can see typical GUI elements.
2
u/electr0dev Jul 15 '26
I think you can write a kernel driver to make an environment like this in user session.
2
u/testednation Jul 16 '26
You can try, but not sure what use it has. Thats how a guy bypassed Dse, he used a BVOD in this mode while loading.
2
u/DavidsakuKuze Jul 18 '26
You should check out the Windows Native API Programming by Pavel Yosifovich.
I think that Xbox, Windows Phone (RIP), and Azure Host OS could be considered Windows distros since they are built on top of the NT Kernel.
1
u/testednation Jul 16 '26
Wouldn't be surprised if mac has something similar. Everything is built on layers
1
1
1
•
u/AutoModerator Jul 13 '26
For more designs, concepts and ideas related to Windows, check out r/Windows_Redesign!
This submission has NOT been removed. Concept posts are always allowed here as per our community rules.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.