the limits of imagination

a week ago, I got a very interesting idea that I'll explain and share here about windows environment subsystems

first, I want to explain 3 different terms that I'll use:

- environment subsystem:
an environment subsystem is responsible of exposing a subset of the native executive functionalities in a clean API called "subsystem DLLs", and it typically consists of a kernel-mode part, which is a driver that managed kernel-mode operations required for the environment subsystem to function, user-mode part, which is in most cases a process that takes notifications for different events (process creation/termination, threads creation/termination, etc..) that relates to this specific subsystem and subsystem DLLs which are the API of the environment subsystem that an application links against to use its functionality.

- application subsystem:
an environment subsystem can include more than application subsystem, for example, Windows (win32) environment subsystem includes GUI application subsystem, which manages GUI apps and CUI application subsystem (the console subsystem) which manages CUI applications.

- kernel/executive subsystem:
this is a part of the kernel or the executive layer that manages a specific layer of NT kernel, for example, the object manager subsystem which manages all the objects in the system, and DirectX graphics subsystem which manages DirectX technology.

historically speaking, NT kernel was designed to support multiple environment subsystems: OS/2, POSIX and win32, now only win32 exists and no support for other subsystems is officially maintained by Microsoft

my goal is to replace win32 environment subsystem (and as a consequence, its application subsystems) with a custom one, giving infinite freedom to customize windows while taking benefit of the extensive HAL (hardware abstraction layer) and hardware acceleration that Microsoft provides!

but this isn't easy nor I'm sure it's even possible, it requires syncing different parts of windows and communication with different applications... I'll call my theoretical environment subsystem "nexus", so let's talk about what should nexus do to get loaded as an environment subsystem instead of win32:

1- it should handshake with SMSS using ALPC IPC mechanism:
SMSS (session manager subsystem) is the first user-mode process created, and it's responsible of making the initial sessions and loading the environment subsystem registered in the registry under this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems

specifically, Required and kmode keys, Required field contains the major environment subsystem that should be loaded upon boot, and kmode contains the kernel mode part of it, there is another field called optional that contains the optional environment subsystem that'll be loaded on-demand, and it was used with POSIX environment subsystem

SMSS uses ALPC IPC mechanism (refer to this article and this lecture for more information about ALPC), any environment subsystem should interact with SMSS in a specific, undocumented message structure and order, nexus should replicate the communication between csrss.exe (the win32 environment subsystem user-mode process) and smss.exe

2- it should manage different hardware components:
NT kernel and its executive layer and different drivers are kernel-mode components, an environment subsystem should wrap all these messy components in a unified, clean API, win32 environment subsystem does this using win32k* drivers which manage the communication with DirectX graphics kernel driver (dxgkrnl.sys) and mouse and keyboard input, nexus should also make a similar driver, and the biggest hurdle in this layer isn't implementation details as much as its the design itself, because this layer is which defines the characteristics and features of the whole environment subsytem!

3- it should provide environment subsystem DLLs and application subsystems

the first one is easy, it'll be "yet another libc implementation and wrappers" style thingy, but the application subsystems are a major part of an environment subsystems, and designing a solid-yet-flexible application subsystems architecture isn't an easy task!

4- it shouldn't annoy patch guard

update:
I searched a bit about this, it seems like PatchGuard is an ally in this context!
if I understand well, PatchGuard scans the SSDT (and other structures) after loading the environment subsystem and takes its content as a reference, then periodically, and if it found any change, it'll immediately trigger a BSOD... but since the reference scan happens after loading the environment subsystem, I could register syscalls for nexusk driver in the second slot of SSDT, which win32k used to use, and PatchGuard should happily protect it from temper! turning to a world-class protection system for my own environment subsystem!!

disclaimer:

This idea is highly experimental and based on limited research. Many assumptions may be incorrect or incomplete.

However, if all components are handled correctly, it might be possible to:

• Boot the NT kernel
• Load a custom environment subsystem
• Render output via the graphics kernel
• Run a minimal user environment 

Motivation

Why attempt something like this?

1. Curiosity

Understanding Windows internals at a deep level.

2. Performance Potential

In theory, this could produce a system that is:

• Extremely minimal
• Possibly faster than Linux (I wish!)

3. Driver Model Advantage

Windows has a strong driver ecosystem, especially for GPUs.

goals:
these are the goals that I should achieve to say that this idea succeeded:
1- be able to load my environment subsystem components (kernel mode, user mode and environment subsystem DLLs) as the only environment subsystem.

2- be able to communicate with VidPN manager and dxgkrnl.sys and wrap them in a unified interface to manager display in the system

3- provide a C standard library implementation (both statically and dynamically linked libraries) to provide basic functionalities for user mode applications to work

3- make a basic TTY environment and shell with some coreutils to demonstrate the environment subsystem is capable of actually working and performing various operations.

sources:
here are some sources that I'm studying and I'd recommend:
1- windows internals 7th editions (part 1 and 2), these are the most valuable for understanding win32 environment subsystem in order to replace its functionalities
2- OSR forums articles, this is the place where you'll find a nerd explaining the exact problem you're facing and giving you the optimal solution for it anonymously 

3- react OS project source code (especially their implementation for smss and csrss), while they're still working on WDDM and dxgkrnl and still working on NT 5.2 (windows server 2003 version), their codebase is very important to clarify stuff even reverse engineering can't

4- dxg driver for linux (link), which provides a good interface to communicate directly with dxgkrnl.sys driver via IOCTLs, this is a definitive source of microsoft itself, no guesses or hacks and totally works with windows 11 and its graphics stack

5- Midipix project: this is a custom musl libc + POSIX API post built up on NT native API to make porting UNIX-targetted source code easier, it's a very rich source for NT native API reverse engineering

deep vibes <3

I'm obsessed with this kinds of vibes guys!!

microsoft MAY make a good thing, yeah, you read it correctly :)

 مع أني بكره ويندوز والتخلف اللي فيه، ولكني مش هظلمه وزي ما تكلم في بوست  بداية الطريق في نظام البطريق عن الحملة العالمية ضد ويندوز بسبب آخر قرارات أخدوها
بتكلم النهاردة عن مقال نزلوه تقدر تقرأه من هنا

المقال حلو وبيتكلم عن خططهم لتحسين التجربة في ويندوز وفيه قرارات أتمنى يطبقوها بشكل كويس
ميزته ف أن مايكروسوفت كان نظامها من سنين هو رمي الطرشة.. مكانوش مهتمين بأي رأي ولا تجربة مستخدم
بيضيفوا ميزات ملهاش لازمة، ف المستخدمين يشتموهم، يشيلوها؟؟ لا يعملوا حل أسوء يحل المشكلة اللي هي ملهاش لازمة أصلاً

المرة دي فيه اختلاف، كتبوا مقال كويس ولو كانت طريقة الكلام كالعادة
corporation slop
 وكلها كلام إنشائي بس لو طبقوها كويس ممكن التجربة في ويندوز تتحسن

أهم حاجة تكلموا عنها هي ال

personalization & customization
performance optimization

بالذات أول نقطة
قالوا أنهم وأخيراً هيضيفوا ميزة أنك تغير مكان التاسك بار وتخليه من فوق تحت يمين شمال أي اتجاه يعجبك
وقالوا أنهم بيغيروا ال
widgets

ويخلوها قابلة للتخصيص أكتر

وقالوا أنهم هيعملوا تحسينات ف الأداء والتخصيص لحاجتين مهمين:
start menu and taskbar
الحاجتين دول مبنيين على حاجة ف ويندوز اسمها:
explorer
وده على عكس ما الناس فاكرة مش مجرد الفايل اكسبلورر اللي بتتصفح منه الملفات
هو عبارة عن
shell
وبرضو على عكس ما الناس فاهمة فكرة الشيل، الشيل نوعين منها اللي بينفذ الأوامر في التيرمنال ومنها الشيل اللي ف ويندوز وهي المسؤولة عن واجهة المستخدم زي شريط المهام وستارت منيو
ومسؤولة عن أجزاء تانية في ويندوز
وبما أنهم هيعدلوها ممكن تبقى قابلة للتخصيص أكتر
هي أصلاً ممكن تبدلها وتستخدم حاجة زي كايرو شيل ابحث عنها على جيتهاب بس عموماً حلو أنهم يحدثوها
وكمان الشيل نفسها مبنية على:
dwm (desktop window manager)
وده الجزء المسؤول عن رسم الشاشة أصلاً
ولكنه للأسف مينفعش تبدله لأنه متداخل مع حاجات كتير ف ويندوز ولو بدلته بأي ويندو مانجير تاني مستحيل ويندوز يشتغل

لو خلوه ممكن يتبدل وعد مني بستخدم ويندوز جنب لينكس ومش بشيله بعد 3 ثانوي!

بيكون أكبر ميزة ف ويندوز وبعدها بيومين بتلاقي 100 مشروع اوبن سورس بيبدله بأداء أحسن وميزات أكتر بمليون مرة
ومش بعيد تلاقي مشروع كايرو شيل نفسه بقى شيل + ويندو مانجير في نفس الوقت

ف أنا فرحان بصراحة بالتصريح ده لأنه أول مرة يستجيبوا لمطالب الناس، وهما برضو مش بقيوا طيبين هما مجرد أن الناس خسرتهم فلوس بس على الأقل أحسن من لا شيء

هما قالوا بينزلوا تحديثات بالميزات الجديدة ل
windows insiders
وهو نسخة من ويندوز للتجربة واختبار الميزات الجديدة فيه مستخدمين بيستخدموها والنظام بيجمع بيانات ويبعتها لمايكروسوفت علشان يقيموا هل الميزات ينفع تتضاف ولا لا
يعني كام شهر مثلاً وبتتضاف لنسخة ويندوز الرسمية اللي احنا بنستخدمها
ننتظر ونشوف

the unified theory of things

for some reason, operating systems developers always try to abstract away everything to one thing and work with that thing!

like UNIX philosophy was "everything is a file".. literally everything, RAM, PC, processes, etc.. all treated as files despite their different nature!

today I discovered something, windows also has similar model.. it treats everything as an "object"

to see this in action we'll need to download WinObjEx tool from sysinternals.. it'll show you most of the objects on your machine

the specific objects I want to show you are those in global key in NT namespace.. this space contains objects such as your hard disk volumes, see this photo for example:

it shows that my PC contains 7 hard disk volumes, but the interesting part is their path.. it's "\Device\HarddiskVolumeX".. what is this?
and where is C: and D: drive letters we are used to?

well, this is a very hard truth but we were in a lifetime illusion, drive letters are just conventions from DOS days that windows pretends they're the hard disk reality, while they're just symbolic links to these paths!

want to see it in action??

this is the field of my D volume, and as you can see it's just a symbolic link for \Device\HarddiskVolume2!

another interesting question, if all hard disk volumes start with that \.. does this mean even NTFS is a tree-like filesystem?
yes!
at the very fundamental level, NTFS is pretty similar to root-based filesystems such as ext4!
the "root" of your hard disk in windows is \\?\, 
my C: volume for example has this path:
\\?\C:\

let's try to use "dir" command to list the D:\ volume, I'll try it both in pwsh core and cmd.exe, in cmd.exe.. it gave me this result:

as you can see dir command successfully identified this weird path and listed D:\ contents.. let's try it in pwsh:

sound weird.. this time it showed nothing, not even an error!

well, I couldn't find why this specifically happen, but I could solve it!

you just need to add -LiteralPath argument to dir command and it'll happily give you the list:
dir -LiteralPath "\\?\D:\"

it gave me similar list to that of cmd.exe!
maybe LiteralPath tells dir to not interpret the path and path it directly to NT native API?
I'm not really sure!

but I just wanted to conclude my post with 2 things:
1- NT kernel is an object-oriented kernel

2- drive letters are just symbolic links, and NTFS is root-based like ext4 filesystem.

the principle of elimination | part 2

this post will not add new information or discuss something but rather will try to clear a misconception that may happen from the previous post (here).

some people may understand that I encourage longer prompts, or that I'm saying "longer prompts lead to better results from LLMs"... this is wrong, longer result doesn't ensure better results, clear prompts do!

let's go back to our small, red ball from the previous post.. we asked 3 questions to predict 2 things.. we asked:

1- how many meters will the ball move (the distance)?
2- where it'll move (the direction)?
3- how many meters it'll move per second (the velocity)?

we wanted to predict its position after it moves and how many second it'd take it to finish the movement..

does this mean the 3 questions were the same importance to predict the 2 results?
not exactly!

let's take 2 examples:

1- I asked you to predict the position of the ball after the movement and gave you one information: the ball will move to left

2- I asked you to predict the position of the ball after the movement and gave you one information: the ball will move 5 meters

the examples are pretty similar except for the information I gave to you, despite that.. they're totally different!

in the first one, the information isn't that important, without it, the search space is infinite, and still it's infinite with this information.. it's not useless but it's not the core information required to predict ball's position!

in the second one.. this single information narrowed down the search space to ONLY 4 possibilities:

1- ball's position will be 5 meters to the left of its current position.

2- ball's position will be 5 meters to the right of its current position.

3- ball's position will be 5 meters to the down of its current position.

4- ball's position will be 5 meters to the up of its current position.

can you see the magic?
one information didn't do that much and another increased the possibility of predicting the right position from practically 0% to 25%!

now let's try to predict the time it'll need to finish the movement with one information each time:
1- its velocity is 5 m/s.

2- it'll move 5 meters

try to predict the time only using 1 information of those 2... well this time it's harder.. it seems like both of the information have "equivalent" importance, we need both of them to answer the question or we'll guess..

how this maps to LLMs?
LLMs have the so-called "attention mechanism", I'll not explain it because I don't understand it but it's proposed by google in "attention is all you need" paper.. it's the mechanism LLMs use to "pay attention" to the most important info that matter the most to predict the next token!

so, it's not about giving longer prompts or more information.. it's about engineering a prompt that gives all information that actually matters!

the magic of LLMs is its attention mechanism, and this is exactly it's bottleneck!
because it scales quadratic-ally (it processes each token compared to all other token).. and this is why we don't have an infinite context window!
because each new token added to the capacity of the context windows requires huge computation power to be added, which is currently limited..

مبدأ الاستبعاد

 أنا مش مهندس ذكاء اصطناعي، والكلام ده مش محتوى موثّق—دي مجرد وجهة نظري الشخصية عن نماذج اللغة الكبيرة (LLMs).

النهارده حابب أتكلم عن نمط لاحظته وأنا بشتغل مع الـ LLMs، وسميته "مبدأ الاستبعاد" (principle of elimination)، لأنه ببساطة بيعبر عن طريقة الشغل معاها. أفضل طريقة للتعامل مع النماذج دي مش إنك تقولها إزاي توصل للإجابة الصح، لكن إنك تستبعد كل الإجابات الغلط المحتملة—أو بمعنى أدق، تقلّص كل (search space) ممكن.

تخيل معايا إن عندنا كرة صغيرة حمرا في مساحة ضخمة جدًا وفاضية، والكرة دي هتتحرك لوحدها، بس إحنا مش عارفين سرعتها كام، ولا هتتحرك في أي اتجاه، ولا هتمشي كام متر… تقدر تقولّي عدد الاحتمالات لمكانها بعد ما تتحرك؟

تقريبًا لا نهائي!

ممكن تتحرك متر واحد لليسار، أو مترين، أو تنزل 3 متر أو 4 متر… وهكذا.

ده غير متوقع بشكل كبير جدًا… طب نقلل العشوائية دي إزاي؟

عن طريق إننا نحدد شوية عوامل تقلل عدد الاحتمالات (combinatorial possibilities).

مثلًا، خلينا نقول إننا متأكدين إن الكرة هتتحرك ناحية اليسار، بس مش عارفين سرعتها ولا المسافة اللي هتمشيها.

دلوقتي عدد الاحتمالات كام؟

لسه كبير جدًا، لكننا على الأقل ضيّقنا (search space)—بقينا بندور بس في الجهة اليسار من مكان الكرة!

طيب نحدد عامل كمان: لنفترض إنها هتتحرك لليسار بمقدار 5 متر بالضبط.

دلوقتي تقدر تحدد مكانها؟

أيوه، هتبقى على بُعد 5 متر ناحية اليسار من مكانها الحالي.

احتجنا عاملين بس علشان نحل المشكلة!

طيب لو سألتك: هتاخد كام ثانية علشان توصل للمكان الجديد؟

مش هتقدر تجاوب لو عارف الاتجاه والمسافة بس—محتاج عامل تالت: السرعة.

خلينا نقول سرعتها 5 متر/ثانية.

يبقى هتاخد كام ثانية؟

ببساطة: ثانية واحدة.

وبرضه احتجنا عاملين علشان نجاوب السؤال ده: المسافة والسرعة.

بعد المثال البسيط ده، نرجع للـ LLMs… إزاي نطلع منها بأفضل نتيجة؟

الـ LLMs شبه جدًا بمحاولة توقع مكان الكرة، لكنها بدل كده بتحاول تتوقع "الإجابة الصح" اللي إنت عايزها.

لو كتبت prompt فاضي، فكأنك بتقولها: توقعي الإجابة الصح من غير أي عوامل محددة!

وده معناه (search space) ضخم جدًا—مش لا نهائي عمليًا، لكنه هائل جدًا لأنه مبني على بيانات الإنترنت كلها تقريبًا.

طب إيه اللي هيحصل؟

غالبًا هتديك إجابة غلط.

طيب لو قلت لها:

"اعمل آلة حاسبة بسيطة بلغة بايثون"

إنت كده قلّصت (search space) بشكل كبير، وبقى عندها فكرة عامة عن المطلوب… لكن لسه مش عارفة التفاصيل.

هل عايزها تاخد 3 inputs منفصلين (رقم، عملية، رقم)؟ ولا تعالج expression كنص؟

إيه العمليات اللي تدعمها؟

هل ده مشروع بسيط لمادة في الكلية؟ ولا محاكاة لآلة حاسبة علمية؟

كل سؤال من دول بيغيّر الكود بشكل كبير.

والمشكلة إن الـ LLMs مش متدربة تسأل الأسئلة دي—هي متدربة تدي إجابات "مفيدة" وخلاص. الشخص اللي يقدر يحدد التفاصيل دي غالبًا بيكون مهندس عنده خبرة.

طيب تخيل إنك كتبت:

"اعمل implementation بلغة بايثون لآلة حاسبة بسيطة بتاخد 3 مدخلات من المستخدم: الرقم الأول، والعملية، والرقم الثاني، وتنفذ العملية بناءً على المدخل، وتدعم العمليات الحسابية الأساسية بس (جمع، طرح، ضرب، قسمة) مع التعامل مع خطأ القسمة على صفر"

الـ prompt ده أطول بكتير، لكن أقدر أقولك بثقة إن لو اديته لأكتر من نموذج، هيدّوا نتائج شبه بعض جدًا.

ليه؟

لأنك قلّصت (search space) لعدد صغير جدًا من الاحتمالات—الاختلاف هيكون بس في أسماء المتغيرات أو الدوال مثلًا…

لكن المنطق نفسه بقى واضح تمامًا.

المهندس الشاطر هو اللي عارف العوامل اللي بتأثر على تصميم وتنفيذ المشروع اللي بيطلبه من الـ LLM، ويقدر يحدد قيم واضحة للعوامل دي… علشان النموذج ما يضطرش "يتخيل" أو "يخمّن" هو إنت تقصد إيه.

(البوست تمت ترجمته بواسطة تشات جي بي تي)

the principle of elimintation

 I'm not an AI engineer and this isn't a verified content as it's a personal view of LLMs.

today I want to talk about a pattern I noticed when working with LLM models, which I called "the principle of elimination" because it's how it works, the best way to work with LLMs isn't to tell it how to find the right answer, but to eliminate each possible wrong answer, or rather, each possible "search space"


imagine we have a small, red ball in a HUGE empty space, and this ball will automatically move, but we don't know how fast it'll move, to any direction and how many meters it'll move.. now can you give me the number of possibilities of its position after it moves?
it's essentially infinite!
the ball can move to left by 1 meter or by 2 meters, or move down by 3 or 4 meters, etc..

this is so unpredictable, how we reduce this?
by specifying some factors to reduce the combinatorial possibilities...

for example, let's say we certainly know the ball will move to left but we don't know how fast and how many meters it'll move!

now what is the number of possibilities?
well, it's still practically infinite but we narrowed down the space we'll search in to predict its position!
we'll only search in the left side of the ball!

let's specify another factor, let's say it'll move to left by exactly 5 meters!

now, can you know its position?
yes!
it'll be 5 meters left to its current position!
we needed 2 factors to be known to solve this problem!

but, what if I asked you how many seconds it'll take the ball to go to the next position?
we can't answer by only knowing the direction and distance!
we need another factor, its speed!

let's specify it's speed to be 5 m/s, meaning it moves 5 meters each second

now how many seconds it'll take it to move to the next position?
obviously, it's 1 second!

how many factors we needed to know this answer?
also 2, the distance it'll move and its speed

well after this imaginary example, let's go back to LLMs.. how to get the best of LLMs?
LLMs are more like us trying to predict the ball position but it rather tries to predict the right answer you look for, if you gave it an empty prompt, you essentially told it to predict the right answer you look for with no factors specified at all (it's not practically an infinite search space but it's exponentially vast since they're trained on the whole data of the internet..)!

how it can do such a thing?

it'll practically give the wrong answer!

what if you told it:
"make a simple calculator in python"

you dramatically reduced the search space, now it knows a lot about what you need to do, but still, it doesn't know how you specifically need it, you gave it an abstract prompt!
do you need the calculator to take the first number, operator and second number as separate inputs or do you want it to parse a string expression?
what operations do you want to support?
is it a simple project for a college assignment or an emulator for a scientific calculator?
each question of those changes the code a lot, and unfortunately LLMs aren't trained to ask such questions as they're trained to produce "useful" and "helpful" answers, only an experienced engineer can answer such questions!


now imagine you told the LLM:
"make a python implementation for a simple calculator that takes 3 inputs from the user, the first operand, the operator and the second operand and perform the operation corresponding to the operator input and it only support basic arithmetic operations (addition, subtraction, multiplication, division) with zero division error handling"

this is a way longer prompt, but I can guarantee that if you gave this prompt to different LLMs, they'll give very similar answers.. because you narrowed down the search space for the right answer to few possibilities that only differ by variable names, function names, etc..

but the logic itself is now obvious to it!

the good engineer is the one who knows the factors that affect the design and implementation of the project he is requesting from LLMs and he can give it a specific values for these factors so it doesn't guess or imagine the user's intent.