How Linux Kernel Runs Executables

[@reyuki-i]

For anyone using the Arch Linux distro, I recommend you use the pre-built version instead of build the bash from source. I spent hours figuring out how to build a static library for libtinfo as it's not available on the distro (yeah, I know, there's definitely a way to build it; I just lack knowledge and need to learn more ^^).

[@nirlichtman]

That's a good point, I haven't tried this on Arch but I'll pin this comment so it could help others as well, additionally here are instructions for downloading a prebuilt static bash on Ubuntu/Debian, after running this you will have bash-static in /tmp/bash-files/bin: "apt download bash-static && mkdir /tmp/bash-files && dpkg -x bash-static*.deb /tmp/bash-files"

[@CryptAmine]

You mean we should use pacstrap instead of building from source ? Cuz I've never seen someone building bash before anyways ( till now )

[@reyuki-i]

@@CryptAmine no, by prebuilt, I mean download the bash's binary from somewhere.. I recommend to pull it from the debian distro (the package name is bash-static), and extract it with dpkg-deb command. (it seems my comment was flagged as spam or smth, I need to rephrase it multiple times, so it passed the comment filter and finally visible to the public)

[@k2ocean]

I just built the bash for just less than a minute, following the simple steps from the README file, I use Arch, and I downloaded the source code from the GNU site, maybe the problem is not in Arch, but in the specific settings of your system

[@cubeman5303]

Just what I needed 1.5h after I should've gone to bed.

[@bastawa]

@@cubeman5303 and here I am, 1:20am, watching this video and reading comments. we are doomed

[@vladislav_artyukhov]

​@@bastawa actually, my recommendation in 1:30am

[@ynav949]

00:00 here and i gotta wake up in 5 hours for work

[@bastawa]

@@ynav949 This is so painful!!! Yesterday at 1:20 I just finished my work, but at least I didn't have to wake up so early!

[@nya0783]

@@cubeman5303 literally watching at 1:50 am, i need to wake up in 5 hours

[@ASSASSIN2143]

Is it even legal to have such a cool explanation?

[@petergerdes1094]

@@ASSASSIN2143 No, the FBI is on its way to protect those of us working in higher education.

[@dazealex]

I don't even need to do debugging right now, but interesting to watch as a C addict.

[@Chris-on5bt]

I like these videos because it it gives a good cross sectional exposure of knowledge: +GDB +C +Linux Kernel Hacking +Binary +Assembly +VMs +Unix commands Informative to me and sharing it with my friend who is getting spun up in computers. Alright nicely with the learning I am doing building the Ben Eater 6502 computer. Thank you!

[@cybernit3]

Ya, I tried to grasp all this, but I need to learn how to use GDB properly, kernel building and then run this kernel in some VM. But he gives a nice simple example about how the kernel loads binary programs into memory. Thanks Nir Lichtman.

[@peanutbutter8885]

This is the coolest video I saw in quite a while, How do you even get started learning all this?

[@darthcabs]

Exactly what I keep asking myself

[@nirlichtman]

Thanks! If you wanna get started I recommend taking a look at the learning resources I maintain in the welcome link on my channel

[@nirlichtman]

@LinuxIsBetter43 yes, because the core stuff remained similar and the book is high quality, but that is good point to keep in mind that the book is quite old and that the source of truth is always the source so it is a good idea to also examine the relavent source along with the according section in the book and to keep in mind that some information may be outdated

[@nirlichtman]

@LinuxIsBetter43 i will add this disclaimer in the welcome page later, its a good point

[@nathanel1313]

While I often watch other YT videos on 1.5 speed, I feel like I should watch Nir's videos on 0.75 speed. So dense, so good. Thank you.

[@nirlichtman]

sorry 😂

[@BabaTova]

I've been learning about kernel development lately, and every day I'm reminded how complicated and intricate the Linux kernel is. Incredible video as always, thank you!

[@vilian9185]

That's why kernel development is devided in subsystems, and deve usually only specialize in one of them

[@BabaTova]

@vilian9185 and then there is Linus Torvalds

[@vilian9185]

@@BabaTova no, he also only review code of the subsystems that he knows, he never reviewed something from file system for example

[@waldmensch2010]

your knowledge about kernel and debugging is brutal :D I use Linux over 30 years and everytime I look your videos, I feel like a noob, please more videos

[@CryptAmine]

I love you that when an ad starts i read the comments instead of skipping

[@randomsearches369]

use uBlockOrigin extension

[@olipellinger]

your tutorials are by far the most valuable ones for me (and trust me I have seen a lot others). Keep up the hard work! Really appreciate it!

[@yaxlu]

Wow! I am so glad youtube recommended this to me. The knowledge here is worth several years of reading docs! Thank you!

[@jorgext]

I rarely comment on videos, but I need to say it here: this is a really good explanation. Congratulations on achieving such a nice and clear video.

[@nirlichtman]

Thanks!

[@sevensolutions77]

This is the exact type of content KZbin needs. Thx 👍

[@neodonkey]

Fantastic video! I learned so much in so little time. I learned a ton about using GDB, and seeing the internals work like this is fascinating. Thanks for doing this!

[@memiux]

nice!

[@nirlichtman]

😂

[@mgord9518]

Thank God you included a newlineI hate when comments aren't formatted correctly

[@RaulAlmeida]

Very nice explanation indeed. Thanks for such informative content.

[@dev.rahulgurjar]

Amazing, such a clear explanation ❤ from India🇮🇳

[@Finkelfunk]

This is so insanely cool! Just to see how the Kernel works on a deep level, really fun to watch!

[@yannberthier8335]

Amazing, this is a very great way to learn something by practice. I see many videos explaining this with theoric approach, but you bring a completly different way to explain that topic. Thanks a lot !

[@NistenTahiraj]

it will never cease the bother me that the cracked linux dev I know that I learned the most from still uses a windos terminal

[@vercolit]

@@NistenTahiraj over my few years as a software engineer, I've really realised that the setup/tools senior engineers use are just what they feel comfortable with. I've seen cracked linux devs on windows, and shitty devs on openbsd/nixos.

[@williandamascenomusic]

It gives you an advantage, if you just broke the entire system, you can reinstall Ubuntu from scratch really easily

[@vilian9185]

Don't matter how good linux is, windows still has better out-of-the-box experience and comes pre-installed, maybe in a future with more atomic Linux distros and better support that start changing(and btw 40% of devs uses Linux, so it's growing and windows becoming annoying lol)

[@vilian9185]

​@@williandamascenomusicsame thing if you use Ubuntu is a VM on linux, WSL is a VM after all

[@Name-gi8dr]

Exactly what I have been wondering but not enough to research myself !

[@TechLord79]

How cute - Win 3.x file manager in the task bar 😄 The epiphany alone how simple it is to create a minimalist Linux is golden and amazing! 👍

[@nirlichtman]

It's actually the open source continuation of it called winfile, Microsoft released the source a couple of years ago :)

[@TechLord79]

@nirlichtman Thanks, yes I know - MS removed the 16-bit subsystem from the x64 OS line, so the original wouldn‘t run, and also not support long file names 😉 But I‘m sure you know.

[@logyross6883]

You never fail to make me realize how little I know about this stuff!🤣 keep up the great work!

[@НиколайКучерявенко-з1ш]

This is so interesting and insightful, thank you for making such videos! I would so want to see more of these, please!

[@nkamkar09]

Niiiiiiiiiiir!!!!! How could you leave us for sooooooo long? 😢😢💔💔. Please don't ever disappear for so long. 🥰🥰

[@ItachiUchiha-cw7zl]

Great Video!! Wonderful explanation.

[@Youshinaka]

It’was really interesting tho I lack soo muck knowledge I need to learn more, you’re giving me some nice motivation

[@UnrealOG137]

It is a crime that you only have 55k subscribers

[@Jonathan-ru9zl]

Great work! In 6:48 how did you split gdb terminal to contain a vim window on the same path?

[@nirlichtman]

thanks! using Vim's windowing feature (I have a vid about multiple windows tips with Vim)

[@RahulJain-wr6kx]

Awesome explanation in a small video 😊😊😊 Thanks a huge ..

[@koderkev42]

Dude this was amazing. I will be looking into more of your videos. You seem to know what you're talking about.

[@rueda-roja]

Very accurate (indeed no other hard currency other than the source code!) and enjoyable, thank you very much! One small addition would be to show the stack before and after iretq ;)

[@nirlichtman]

That's a good point!

[@CharaVerKys]

nice video, ill see more from this channel, very interesting, i feel like if ill watch many of this ill know more about systems

[@RooiGevaar19]

אלוף! 😊 הסרטונים שלך מדהימים! ברכות מהלינוקס הפולני שלי! 😊

[@nirlichtman]

תודה!

[@ricargoncalves]

Very good! Very informative! Love it!

[@bhaveshverma8629]

Yup very deep dive. Bro how did you study so deep dive. I have 8 years of experience in coding but I don't have deeper knowledge like you. Very nice. Hope I can also achieve that level of knowledge

[@der.Schtefan]

make -j0 will adjust to the number of your CPU cores. Your NVMe SSD is fast enough to keep up with the I/O, even on a 24 threads processor.

[@sakurako-omuroo]

or j$(nproc)

[@nirlichtman]

Thanks for the tip!

[@lebanbo55]

I happened to just research how the Windows kernel runs .exe programs yesterday and found that the two are very similar in their overall ideas. The difference is the specific function names.

[@theairaccumulator7144]

@LinuxIsBetter43 Windows NT was made way before Linux had any semblance of popularity and the concept of "open source" as it's known today didn't exist back then. It was only a thing in hacker communities, corporations still used only proprietary or in-house solutions.

[@piotrc966]

​ @LinuxIsBetter43 WindowsNT was designed and written by an experienced team that already had VMS and the MICA project to its credit. Dave Cluter was in charge and the NT project took off in 1988. By 1993 it was a ready-to-sell project. Linux at that time was completely underdeveloped. E.g. threads didn't appear on Linux until 2000, and dynamic modules in 2003. Windows had these basic things since 1993. Linux was years behind.

[@smithnigelw]

Thank you. Really interesting. I must try this out myself.

[@sparshpriyadarshi]

its like a brain surgeon explaining how they do it with a POV explanation. love it.

[@aioia3885]

that is really cool, great video! my only complaint is that you're not using the TUI mode of gdb, it's so much nicer in my opinion!

[@nirlichtman]

Thanks! I haven't used the TUI mode in a long time, maybe I'll give it another look some time

[@CuteLittleHen]

אח שלי, אתה מדהים! תוכן ברמה גבוהה!

[@nirlichtman]

תודה!

[@RooiGevaar19]

אלוף! 😊

[@eitantal726]

14:39 "iret" is interrupt-return, yes. But this is iretQ. what's the 'q' for?

[@nirlichtman]

q stands for quad-word since this is x64 (addresses are 64bit so "quad" bytes), I actually wanted to also show the instruction documentation in the Intel SDM but in the end decided not to since the video got longer than I anticipated

[@eitantal726]

@@nirlichtman interesting. kind of like "NEAR"/"FAR" but for x64?

[@dorovich4735]

Very useful inormation about a lot of stuff, thank you!

[@bagfleet]

Just curious. Why aren’t you daily driving linux instead of windows?

[@nirlichtman]

Check out the common questions on the welcome link on my channel

[@amitkeren7771]

One of the greatest vids I saw!

[@jonesy_b]

understood barely anything of it, still hella cool video 🙏🙏🙏

[@EngineerNick]

Nice! :) Thankyou for the amazing video and concice explanation!

[@compositeboson123]

nobody: nir in every video: lets build the linux kernel

[@MahdiSharifi-us7bl]

Excellent video. Loved it.

[@evildragon1774]

hmm this is interesting. I just knew that i have to learn gdb more deeply

[@eitantal726]

Nah, I recommend the exact opposite. Familiarize yourself with debugging in general, ideally with a very graphically visible and user-friendly debugger a-la VSCode. When you understand these things, gdb will make perfect sense, albeit having very limited visibility. CLI gdb feels like driving a car, but with a terminal, rather than with my eyes and hands

[@aah134-K]

Welcome back

[@Momentvm]

This channel is golden!

[@ahming2000]

15:25 Just do some additional research on this and found out that the "demand paging" was actually a cool example of "bug becomes a feature" 😂

[@katiagalkina4607]

great as always! 😊

[@knecht3000]

This is amazing content. So much information with almost no "magic" happening. However, I couldn't follow completely regarding the ip register 😅 the kernel loads the virtual address of the programs code section into the ip register of a task struct associated with the hello process that's not yet running right? But is there something happening before returning to user mode? I would have expect that the scheduler runs first and picks a task struct(which hello is now one of them) and in case it picks hello we end up in user mode where you end up but we could also end up at another user mode process. So I don't completely got where the scheduler schedules the hello process and writes it's register values to the HW. I guess what you showed was only writing to a task struct that will be written to hw when the process is scheduled?

[@nirlichtman]

Thanks! Regarding the instruction pointer, a few corrections, first notice that the kernel loads the address of the entry point function to the instruction pointer (and not the address of the beginning of the text section). secondly, an important clarification regarding execve, it does not create a new process but rather "switches" the process that called execve to be a different program, so the kernel does not need to create a new process in this flow (new process creation can be done with fork or clone for example, but both of them do not switch the process to be a totally different program, so a common flow is to first fork/clone and then execve). The scheduler will eventually kick in and re-estimate which process to run next, but after the kernel finishes handling the system call and the iret instruction is executed, control is returned back to the last user mode process that was run, which is now starting with the completely new program and with the instruction pointer set to the entry point

[@JoseLuisOchoaPadilla]

now _this_ is debugging...

[@균서]

wow very helpful thanks 😊

[@Name-gi8dr]

God damn, at the end I just noticed that he's using WSL. It's just so funny 😂

[@sophiatheodores7985]

can you talk about how wine picks up the windows executables you run on linux? pretty sure its a similar mechanism

[@nitsanbh]

Wonderful as always

[@eliphazbouye]

very great video, but I have One question what is your process to learn, go deeper and more ?

[@nirlichtman]

A combination of reading docs, sections from books, watching videos/lectures, articles and alongside that working with debuggers and the source code to see things in practice. I have a list of recommended learning resources BTW on my welcome link on the channel.

[@eliphazbouye]

@@nirlichtman Great thank you 😊

[@Cyclically]

underrated user

[@ThanassisTsiodras]

Nice. BTW, your viewers may enjoy watching your GDB sessions more in TUI mode ("tui enable").

[@nirlichtman]

Thanks, I think I tried it a little bit a couple of years ago, but that is a good idea, I'll look into it again

[@eitantal726]

12:00 what does this macro do? (other than calling a function with the same name)

[@nirlichtman]

Are you referring to the START_THREAD macro? in the flow demonstrated in the video it just passes through almost all the arguments to start_thread, except the first argument.

[@eitantal726]

@@nirlichtman So it just omits the 1st argument & nothing else? my thinking is, if there's a macro, there's often a reason for a macro.

[@0xgordo350]

Nice video. Make us a video where you show how the kernel handles the algorithm to kill random proccess when it is out of memory

[@nirlichtman]

Thanks! I have a video on OOM, it's called something like what happens when Linux is out of memory

[@Sadiinso]

Is there a reason as to why the first page of code isn't loaded as soon as the new process is "started" ? (why wait for it to immediately page fault instead ?)

[@art0007i]

@@Sadiinso my best guess is that it wouldn't save that much performance, and the page fault handling is a very generic mechanism that applies to a lot of cases outside of this one too

[@nirlichtman]

Yah, that's a good point, I thought about it as well, @art0007i makes a good point, indeed it probably wouldn't be much of a performance gain, especially considering that execve is a relatively "uncommon" operation

[@divadgnol67]

Thank you

[@yaseentahseen1300]

Wow but how do windows exe executed in kernel and what is used in the kernel for it to ran because the kernel it self in sys32 folder is an exe so how do it ran?

[@manofares1342]

לאן נעלמת? כבר דאגנו יאח

[@Mysterious_debris_1111]

Omg, this sh*t is crazy, mind blowing videos

[@iamwitchergeraltofrivia9670]

😊😊😊😊 always Kernel Security

[@kebugcheck]

Great job!!

[@guilherme5094]

👍Thanks!

[@JoeNopos]

This is awesome! I mean ... nice!

[@tomershechner]

על איזה דיסטרו אתה אחי? עריכה: כאילו אני רואה שזה WSL, אבל איזה בחרת?

[@nirlichtman]

דביאן

[@divadgnol67]

@@tomershechner arch Linux??, maybe

[@kaslmineer7999]

Gibberish writing.

[@VivekYadav-ds8oz]

This sounds like it's straight out of some made-up Star Wars language. If not, I apologise for my ignorance.

[@tomershechner]

@@VivekYadav-ds8oz It's Hebrew

[@lllsophisticatedlll]

Love it

[@王阿哥-q2d]

Can you tell me how you use Linux in a Windows terminal? I look forward to you making a video about your development environment.

[@nirlichtman]

I use Debian with WSL, I have some info about my setup in the welcome link on my channel

[@王阿哥-q2d]

@@nirlichtman That's awesome! What model of laptop do you mainly use?

[@nirlichtman]

@王阿哥-q2d lenovo y50

[@王阿哥-q2d]

@@nirlichtman Unbelievable! You've created so many amazing videos on a 10-year-old laptop. What hardware are you using for the laptop running OpenBSD?

[@nirlichtman]

@王阿哥-q2d yah i am generally a fan of older stuff, but the laptop still runs great :) i am using OpenBSD with a 2009 Sony Vaio P

[@PrinceKumar-u4k4y]

His fun directory contains bash, mine contains games 😂😂

[@FintMC]

i am having trouble compiling the linux kernel on my machine: when running `make` after doing all configs and getting everything downloaded the build process terminates on libelf headers because there are macros that are undefined, and linux includes them with `-Werror` which turns warnings into errors. is there any easy way to fix this issue? i searched online and found this was a common issue but did seem to find any fix for it

[@nirlichtman]

Interesting haven't stumbled upon a problem like this, but in general you can config the kernel to not treat warnings as errors by going to the menuconfig -> general settings and unchecking that box, not an optimal solution since it wouldn't treat the source of the problem, but it can help you at least get past this right now and successfully build the kernel before investigating further if you would want.

[@FintMC]

​@@nirlichtman i tried doing just that and with `defconfig` configuration and it seems to ignore that - still passes `-Werror=undef` to the compiler. just tried with `tinyconfig` instead and everything seems to work now. i checked and tinyconfig by default doesnt check warnings as errors Edit: checking the `64-bit kernel` option seems to trigger this no matter what

[@nirlichtman]

@@FintMC Hmm, may be a bug in the kernel, are you using the upstream master from torvalds? I would recommend trying to pinpoint the exact location in the makefiles where it still passes the warning as error flag, from what you have sent so far seems the problem is around ELFs so maybe it is related to the fs/ Makefiles, if you have an idea how to fix, you can submit a patch if you want

[@FintMC]

@@nirlichtman the errors seem to occur anywhere any libelf header is included, i tried to edit those directly to define undefined macros with 0s (bad solution but it works), now i get more other errors from the actual kernel code. i tried to edit the config to see whether there was the warning->error option and it appeared unset so i set it to 'n' and all warnings are still errors after rerunning make E: the config seems to update and unset the CONFIG_WERROR option, which still doesnt apply

[@nirlichtman]

If you use defconfig, but uncheck the ELF format support option in the executable formats supported menu in the menuconfig, does it build successfully?

[@evilmortyofficial]

Can you make a video about Kernel exploits?

[@nirlichtman]

I don't know a lot about that topic so no videos about that planned in the near future

[@dylanh333]

That went *deep*

[@kaslmineer7999]

Really cool

[@kaslmineer7999]

I love the content made by you

[@ChandrashekarCN]

💖💖💖💖

[@sakurako-omuroo]

good job

[@eitantal726]

how do you know all this? did you read it somewhere? trial & error? taught this? learned on-the-job?

[@peanutbutter8885]

I had the same question, What leads to here?

[@nirlichtman]

In general or referring to the demonstration in the video?

[@eitantal726]

@@nirlichtman This video in particular, but yes, but also in general. How do you know so much? are the man pages really that good?

[@suzukiaccess5022]

@nirlichtman how about a tutorial series on windbg?

[@nirlichtman]

I have a couple of windbg videos on my Windows diving playlist, and next video will be a Windows topic :)

[@suzukiaccess5022]

@ thanks! I have watched and enjoyed those videos too. At some point, when you have time, make a video on using windbg to debug applications and read application memory dumps? The existing videos are focused towards windows internals

[@nirlichtman]

@suzukiaccess5022 oh you mean a source level application debugging video, and a video about analyzing crash dumps of apps that crashed? good ideas i'll consider those for future vids

[@DocSineBell]

I didn't understand shit but this is so cool anyway

[@arielguts]

nir yamelech!!

[@nirlichtman]

todaa!!!

[@sayyedmohsenzahraee1372]

nice hacks Could you tell me how to split the GDB and search for functions?

[@nirlichtman]

You mean split screen? I like using Vim built-in window managment commands (I have a vid on that). And to search functions in GDB, check out "info func" (help info)

[@maxmustermann5590]

Are you a wizard?

[@theairaccumulator7144]

Doing all this inside WSL lol

[@0xssff]

damn

[@Barry_L]

windows is just bad for development and this is the reason why

[@CjqNslXUcM]

I didn't know the kernel actually interprets the shebangs. Makes sense given the way script execute permissions work, but it seems like a waste of resources. In hindsight, so much of unix is haphazardly designed.

[@cosmicusstardust3300]

ewww windows

[@gelules]

Sorry to say, but the hybrid Windows kernel is a way better kernel than the damn monolithic Linux kernel. So.... ewwww Linux!

[@evildragon1774]

let the man use it. it doesn't hurt anyone

[@mickolesmana5899]

i love it when the guy who casually swim in an out of a core of linux itself use Windows as a host, and watching linux fanboy cringe over it

[@cosmicusstardust3300]

@@gelules That Microsoft copium you're taking must be really strong lol Having the Linux as a monolithic design actually works well considering the fact all the drivers/firmware for all your hardware is right there ready to use in the Kernel and the fact its super versatile with so many use cases being a for a desktop OS, server, supercomputer, etc. There's a reason 96% of the internet is powered by Linux and not Windows. But yes keep buying Windows subscriptions and believe in the the bs, by all means.

[@gelules]

​@@cosmicusstardust3300 Lol, I've never bought any windows subscriptions or whatsoever, I use Linux everyday. But on the osdev design, a monolithic kernel is by far not the best choice. Linux is not only a monolithic kernel, but a modular one. You can insert any module inside the one and only kernel space, if your module crashes, the whole kernel crashes too, where's the security in that? Take a look at seL4, that's a way better approach to develop a kernel.

[@EiziEizz]

What kind of weirdo does linux kernel debugging on a microsuck OS?

[@benarcher372]

Great job!

[@meni181818]

nice!

[@nirlichtman]

thanks meni! :)