We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu.

Also can .efi files be run? In that way I can try bootmgr.efi to load ntoskrnl.exe.

  • I’m voting to close this question because it doesn't seem to specifically concern reverse engineering. May 16 '21 at 0:01

Linux kernel can boot mostly on its own by probing the hardware and using the linked-in drivers. The NT kernel requires an environment such as UEFI or legacy BIOS and relies on it, for example, to load additional drivers. It also expects to be loaded in a certain manner by the pre-loader (winload.efi) while Linux has less strict requirements.

This is why QEMU can provide built in support for booting Linux - it’s much simpler to implement. For Windows you need to prepare a disk image with the file system and a UEFI environment such as OVMF. The Windows kernel uses registry (BCD - Boot configuration data) for configuration instead of command line arguments so it’s trickier to implement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.