I'm experimenting with adding native Windows PE execution to Linux — (Project Tawi)
I've been working on a personal project called **Tawi**, and I figured r/linux might be interested in the direction I'm taking it.
The long-term idea is to build a Linux-based environment that can run Linux applications normally while also gaining the ability to execute Windows applications through a native compatibility layer.
I'm **not trying to replace Wine overnight**, and this is nowhere near production-ready. This is an experimental project where I'm trying to understand how far I can take Windows PE execution directly from the Linux kernel.
Right now I've been working on a custom `binfmt` handler for PE32+ executables.
The current loader can:
* Recognize x86-64 PE32+ executables
* Parse the PE headers
* Map the PE image into userspace
* Load its sections
* Find the PE Import Directory
* Patch the Import Address Table
* Transfer execution to the PE entry point
* Provide userspace trampolines for a small number of Win32 APIs
And today I got my first actual Windows console output:
~ # chmod +x ./hello2.exe
~ # ./hello2.exe
[ 18.701711] tawi: loading ./hello2.exe: entry_rva=0x1000 image_base=0x140000000 size=0x6000
[ 18.703078] tawi: mapped .text at 0x140001000 (0x200 bytes)
[ 18.703522] tawi: mapped .rdata at 0x140002000 (0x200 bytes)
[ 18.703706] tawi: mapped .pdata at 0x140003000 (0x200 bytes)
[ 18.703852] tawi: mapped .xdata at 0x140004000 (0x200 bytes)
[ 18.704109] tawi: mapped .idata at 0x140005000 (0x200 bytes)
[ 18.704481] tawi: trampoline page at 0x7ffff7ffe000
[ 18.704699] tawi: import DLL: KERNEL32.dll
[ 18.705014] tawi: [+] KERNEL32.dll!ExitProcess -> 0x7ffff7ffe000
[ 18.705282] tawi: [+] KERNEL32.dll!GetStdHandle -> 0x7ffff7ffe040
[ 18.705496] tawi: [+] KERNEL32.dll!WriteFile -> 0x7ffff7ffe080
[ 18.705720] tawi: transferring control to entry point 0x140001000
Hello from Windows!
The executable itself is a normal Windows program using the Win32 API:
#include <windows.h>
void start(void)
{
HANDLE h = GetStdHandle(STD_OUTPUT_HANDLE);
DWORD written;
const char *msg = "Hello from Windows!\n";
WriteFile(h, msg, 21, &written, NULL);
ExitProcess(0);
}
The interesting part for me is that the Win32 calls are currently being redirected through small userspace trampolines that translate them into functionality provided by Linux.
Obviously, there is an enormous amount missing.
Currently there is no general Win32 compatibility layer, no relocation support, very limited API coverage, and many normal Windows executables won't work at all. I'm deliberately building this incrementally rather than trying to implement all of Win32 at once.
The next goals are things like:
* More Win32 API implementations
* Proper PE relocations
* Better PE validation and memory protections
* Process/runtime initialization
* DLL loading
* A real Win32 compatibility layer
* Eventually testing against increasingly complex Windows applications
The bigger question I'm exploring is:
**How far can you push native Windows application support inside a Linux-based OS if you build the compatibility layer as part of the OS rather than treating it purely as an external runtime?**
That's what Tawi is about.
It's currently very much a "break the kernel and stare at `dmesg`" kind of project, but getting `Hello from Windows!` out of a PE executable running under my modified Linux kernel was a pretty damn satisfying milestone.
I'd love to hear thoughts from people who have worked on `binfmt`, PE/COFF, Wine, compatibility layers, or kernel internals.
\------------------------------------------------------------------------------------------------------------------------------------
***Tawi*** *comes from the ancient Egyptian concept of* ***“the Two Lands”*** *— Upper and Lower Egypt.*
*For the project, it represents* ***bringing two worlds together****: the Linux and Windows application
